diff options
| author | Andreas Kling <awesomekling@gmail.com> | 2020-01-17 11:12:06 +0100 |
|---|---|---|
| committer | Andreas Kling <awesomekling@gmail.com> | 2020-01-17 11:19:06 +0100 |
| commit | 26a31c7efbb62e2836a2199a27e6377c50cc1896 (patch) | |
| tree | f00732a2acd59eaa5a99858db8732d4b4c5e7001 /Base/usr/share | |
| parent | a9b24ebbe86e2d3e98631454922ec08f4119c64b (diff) | |
| download | serenity-26a31c7efbb62e2836a2199a27e6377c50cc1896.zip | |
Kernel: Add "accept" pledge promise for accepting incoming connections
This patch adds a new "accept" promise that allows you to call accept()
on an already listening socket. This lets programs set up a socket for
for listening and then dropping "inet" and/or "unix" so that only
incoming (and existing) connections are allowed from that point on.
No new outgoing connections or listening server sockets can be created.
In addition to accept() it also allows getsockopt() with SOL_SOCKET
and SO_PEERCRED, which is used to find the PID/UID/GID of the socket
peer. This is used by our IPC library when creating shared buffers that
should only be accessible to a specific peer process.
This allows us to drop "unix" in WindowServer and LookupServer. :^)
It also makes the debugging/introspection RPC sockets in CEventLoop
based programs work again.
Diffstat (limited to 'Base/usr/share')
| -rw-r--r-- | Base/usr/share/man/man2/pledge.md | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/Base/usr/share/man/man2/pledge.md b/Base/usr/share/man/man2/pledge.md index b5e7c030bf..b8223e8e42 100644 --- a/Base/usr/share/man/man2/pledge.md +++ b/Base/usr/share/man/man2/pledge.md @@ -34,6 +34,7 @@ If `promises` or `execpromises` is null, the corresponding value is unchanged. * `exec`: The [`exec(2)`](exec.md) syscall * `unix`: UNIX local domain sockets * `inet`: IPv4 domain sockets +* `accept`: May use [`accept(2)`](accept.md) to accept incoming socket connections on already listening sockets. It also allows [`getsockopt(2)`](getsockopt.md) with `SOL_SOCKET` and `SO_PEERCRED` on local sockets * `rpath`: "Read" filesystem access * `wpath`: "Write" filesystem access * `cpath`: "Create" filesystem access |