MenuApplets: Use unveil()

The Clock and Audio applets really only need ("/res", "r") for LibGUI.

The CPUGraph applet also needs ("/proc/all", "r") for reading the CPU
usage data. Somewhat surprisingly, this also adds ("/etc/passwd", "r")
since CProcessStatisticsReader does username lookups.

3 files changed, 34 insertions, 0 deletions

diff --git a/MenuApplets/Audio/main.cpp b/MenuApplets/Audio/main.cpp
index d326df72d1..3b79974096 100644
--- a/MenuApplets/Audio/main.cpp
+++ b/MenuApplets/Audio/main.cpp
@@ -96,6 +96,13 @@ int main(int argc, char** argv)
     window->set_main_widget(widget);
     window->show();
 
+    if (unveil("/res", "r") < 0) {
+        perror("unveil");
+        return 1;
+    }
+
+    unveil(nullptr, nullptr);
+
     if (pledge("stdio shared_buffer accept rpath", nullptr) < 0) {
         perror("pledge");
         return 1;
diff --git a/MenuApplets/CPUGraph/main.cpp b/MenuApplets/CPUGraph/main.cpp
index b8e3365c59..244d1c4fb8 100644
--- a/MenuApplets/CPUGraph/main.cpp
+++ b/MenuApplets/CPUGraph/main.cpp
@@ -117,5 +117,25 @@ int main(int argc, char** argv)
     auto widget = GraphWidget::construct();
     window->set_main_widget(widget);
     window->show();
+
+    if (unveil("/res", "r") < 0) {
+        perror("unveil");
+        return 1;
+    }
+
+    // FIXME: This is required by CProcessStatisticsReader.
+    //        It would be good if we didn't depend on that.
+    if (unveil("/etc/passwd", "r") < 0) {
+        perror("unveil");
+        return 1;
+    }
+
+    if (unveil("/proc/all", "r") < 0) {
+        perror("unveil");
+        return 1;
+    }
+
+    unveil(nullptr, nullptr);
+
     return app.exec();
 }
diff --git a/MenuApplets/Clock/main.cpp b/MenuApplets/Clock/main.cpp
index 98a170ac4e..200f230cb7 100644
--- a/MenuApplets/Clock/main.cpp
+++ b/MenuApplets/Clock/main.cpp
@@ -111,5 +111,12 @@ int main(int argc, char** argv)
     window->set_main_widget(widget);
     window->show();
 
+    if (unveil("/res", "r") < 0) {
+        perror("unveil");
+        return 1;
+    }
+
+    unveil(nullptr, nullptr);
+
     return app.exec();
 }