SDL: Add option to drop privileges with unveil()/pledge()

CMakeLists.txt

@@ -34,6 +34,9 @@ if(NOT LIBMGBA_ONLY)
 		set(USE_EDITLINE ON CACHE BOOL "Whether or not to enable the CLI-mode debugger")
 	endif()
 	set(USE_GDB_STUB ON CACHE BOOL "Whether or not to enable the GDB stub ARM debugger")
+	if (CMAKE_SYSTEM_NAME STREQUAL OpenBSD)
+		set(USE_PLEDGE ON CACHE BOOL "Whether or not to drop privileges with pledge")
+	endif()
 	set(USE_FFMPEG ON CACHE BOOL "Whether or not to enable FFmpeg support")
 	set(USE_ZLIB ON CACHE BOOL "Whether or not to enable zlib support")
 	set(USE_MINIZIP ON CACHE BOOL "Whether or not to enable external minizip support")
@@ -465,6 +468,10 @@ if(DISABLE_DEPS)
 	set(USE_ZLIB OFF)
 endif()
 
+if(USE_PLEDGE)
+	set(USE_EPOXY OFF)
+endif()
+
 set(WANT_ZLIB ${USE_ZLIB})
 set(WANT_PNG ${USE_PNG})
 set(WANT_SQLITE3 ${USE_SQLITE3})
@@ -489,6 +496,10 @@ find_feature(USE_SQLITE3 "sqlite3")
 find_feature(USE_ELF "libelf")
 find_feature(ENABLE_PYTHON "PythonLibs")
 
+if(USE_PLEDGE)
+	set(USE_EPOXY OFF)
+endif()
+
 if(USE_FFMPEG AND NOT DEFINED VCPKG_TARGET_TRIPLET)
 	set(USE_LIBAVRESAMPLE ON)
 	set(USE_LIBSWRESAMPLE ON)
@@ -520,6 +531,10 @@ if(USE_GDB_STUB)
 endif()
 source_group("Debugger" FILES ${DEBUGGER_SRC})
 
+if(USE_PLEDGE)
+	list(APPEND FEATURES PLEDGE)
+endif()
+
 if(USE_FFMPEG)
 	list(APPEND FEATURES FFMPEG)
 	if(USE_LIBSWRESAMPLE)

src/platform/sdl/main.c

@@ -44,6 +44,11 @@ static void mSDLDeinit(struct mSDLRenderer* renderer);
 
 static int mSDLRun(struct mSDLRenderer* renderer, struct mArguments* args);
 
+#ifdef USE_PLEDGE
+static bool mPledgeBroad(struct mArguments* args);
+static bool mPledgeNarrow(struct mArguments* args);
+#endif
+
 static struct VFile* _state = NULL;
 
 static void _loadState(struct mCoreThread* thread) {
@@ -149,6 +154,20 @@ int main(int argc, char** argv) {
 	renderer.player.bindings = &renderer.core->inputMap;
 	mSDLInitBindingsGBA(&renderer.core->inputMap);
 	mSDLInitEvents(&renderer.events);
+
+#ifdef USE_PLEDGE
+	if (!mPledgeBroad(&args)) {
+		freeArguments(&args);
+		mCoreConfigDeinit(&renderer.core->config);
+		mInputMapDeinit(&renderer.core->inputMap);
+		renderer.core->deinit(renderer.core);
+		mSDLDeinitEvents(&renderer.events);
+		mSDLDeinit(&renderer);
+		fputs("Broad pledge() failed\n", stderr);
+		return 1;
+	}
+#endif
+
 	mSDLEventsLoadConfig(&renderer.events, mCoreConfigGetInput(&renderer.core->config));
 	mSDLAttachPlayer(&renderer.events, &renderer.player);
 	mSDLPlayerLoadConfig(&renderer.player, mCoreConfigGetInput(&renderer.core->config));
@@ -264,6 +283,12 @@ int mSDLRun(struct mSDLRenderer* renderer, struct mArguments* args) {
 					state->close(state);
 				}
 			}
+#ifdef USE_PLEDGE
+			if (!mPledgeNarrow(args)) {
+				didFail = true;
+				fputs("Narrow pledge() failed\n", stderr);
+			}
+#endif
 			renderer->runloop(renderer, &thread);
 			mSDLPauseAudio(&renderer->audio);
 			if (mCoreThreadHasCrashed(&thread)) {
@@ -312,3 +337,43 @@ static void mSDLDeinit(struct mSDLRenderer* renderer) {
 
 	SDL_Quit();
 }
+
+#ifdef USE_PLEDGE
+static bool mPledgeBroad(struct mArguments *args) {
+	if (args->debuggerType == DEBUGGER_CLI) {
+		if (pledge("stdio rpath wpath cpath inet fattr unix dns sendfd prot_exec tty drm audio", NULL) == -1) {
+			return false;
+		}
+#ifdef USE_GDB_STUB
+	} else if (args->debuggerType == DEBUGGER_GDB) {
+		if (pledge("stdio rpath wpath cpath inet fattr unix dns sendfd prot_exec drm audio", NULL) == -1) {
+			return false;
+		}
+#endif
+	} else {
+		if (pledge("stdio rpath wpath cpath inet fattr unix dns sendfd prot_exec drm audio", NULL) == -1) {
+			return false;
+		}
+	}
+	return true;
+}
+
+static bool mPledgeNarrow(struct mArguments *args) {
+	if (args->debuggerType == DEBUGGER_CLI) {
+		if (pledge("stdio rpath wpath cpath fattr sendfd tty prot_exec drm audio", NULL) == -1) {
+			return false;
+		}
+#ifdef USE_GDB_STUB
+	} else if (args->debuggerType == DEBUGGER_GDB) {
+		if (pledge("stdio rpath wpath cpath inet fattr sendfd prot_exec drm audio", NULL) == -1) {
+			return false;
+		}
+#endif
+	} else {
+		if (pledge("stdio rpath wpath cpath fattr sendfd prot_exec drm audio", NULL) == -1) {
+			return false;
+		}
+	}
+	return true;
+}
+#endif