From edee68f398f5b190f4be0127338956c0a2500662 Mon Sep 17 00:00:00 2001
From: Hiltjo Posthuma <hiltjo@codemadness.org>
Date: Sun, 1 Dec 2019 18:31:07 +0100
Subject: add OpenBSD unveil support

The unveil() system call first appeared in OpenBSD 6.4.

For stagit it has the following properties now:

- stagit-index: only read-access to the file-system for the specified
  directories/repositories.
- stagit: read-access to the specified directory/repository.
  read-write and creation access to the current directory for the output files.
  read-write and creation access to the specified cache file.
---
 stagit-index.c | 3 +++
 1 file changed, 3 insertions(+)

(limited to 'stagit-index.c')

diff --git a/stagit-index.c b/stagit-index.c
index cc70e4d..9a1f902 100644
--- a/stagit-index.c
+++ b/stagit-index.c
@@ -159,6 +159,9 @@ main(int argc, char *argv[])
 	git_libgit2_init();
 
 #ifdef __OpenBSD__
+	for (i = 1; i < argc; i++)
+		if (unveil(argv[i], "r") == -1)
+			err(1, "unveil: %s", argv[i]);
 	if (pledge("stdio rpath", NULL) == -1)
 		err(1, "pledge");
 #endif
-- 
cgit v1.2.3