Declare OpenBSD pledge(2) (#5)

Gopkg.lock

@@ -25,6 +25,6 @@
 [solve-meta]
   analyzer-name = "dep"
   analyzer-version = 1
-  inputs-digest = "f0abeb920368b3b2e50d99f6e5705f0ad6ccd5f7e708f639b6c1fa0820364a22"
+  inputs-digest = "559be3832a82b6c8884ca8103c92b2343135b96374cdf98f6cc294427bd26219"
   solver-name = "gps-cdcl"
   solver-version = 1

main.go

@@ -2,8 +2,10 @@ package main
 
 import (
 	"flag"
+	"fmt"
 	"os"
 
+	"github.com/maximbaz/browserpass-native/openbsd"
 	log "github.com/sirupsen/logrus"
 )
 
@@ -17,16 +19,18 @@ func main() {
 	flag.BoolVar(&version, "version", false, "print version and exit")
 	flag.Parse()
 
+	if version {
+		fmt.Println("Browserpass host app version:", VERSION)
+		os.Exit(0)
+	}
+
+	openbsd.Pledge("stdio rpath proc exec")
+
 	log.SetFormatter(&log.TextFormatter{FullTimestamp: true})
 	if verbose {
 		log.SetLevel(log.DebugLevel)
 	}
 
-	if version {
-		log.Info("Browserpass host app version: ", VERSION)
-		os.Exit(0)
-	}
-
 	log.Debugf("Starting browserpass host app v%v", VERSION)
 	process()
 }

openbsd/generic.go

@@ -0,0 +1,7 @@
+// +build !openbsd
+
+package openbsd
+
+// Pledge allowed system calls, available only on OpenBSD systems
+func Pledge(promises string) {
+}

openbsd/openbsd.go

@@ -0,0 +1,10 @@
+// +build openbsd
+
+package openbsd
+
+import "golang.org/x/sys/unix"
+
+// Pledge allowed system calls
+func Pledge(promises string) {
+	unix.Pledge(promises, nil)
+}