pledge fvwm and FvwmPager (since it's started by default); committing to

solicit further feedback and testing.

ok matthieu and encouragement from deraadt

2 files changed, 8 insertions, 0 deletions

diff --git a/app/fvwm/fvwm/fvwm.c b/app/fvwm/fvwm/fvwm.c
index 09876a785..decd86653 100644
--- a/app/fvwm/fvwm/fvwm.c
+++ b/app/fvwm/fvwm/fvwm.c
@@ -19,6 +19,7 @@
 #include <fcntl.h>
 #include <string.h>
 #include <unistd.h>
+#include <err.h>
 #include "fvwm.h"
 #include "menus.h"
 #include "misc.h"
@@ -525,6 +526,9 @@ int main(int argc, char **argv)
   fFvwmInStartup = False;
   DBUG("main","Entering HandleEvents loop...");
 
+  if (pledge("stdio rpath proc exec", NULL) == -1)
+	  err(1, "pledge");
+
   HandleEvents();
   switch( fvwmRunState )
   {
diff --git a/app/fvwm/modules/FvwmPager/FvwmPager.c b/app/fvwm/modules/FvwmPager/FvwmPager.c
index f7943ad68..4ed63d572 100644
--- a/app/fvwm/modules/FvwmPager/FvwmPager.c
+++ b/app/fvwm/modules/FvwmPager/FvwmPager.c
@@ -20,6 +20,7 @@
 #include <sys/time.h>
 #include <unistd.h>
 #include <ctype.h>
+#include <err.h>
 
 #ifdef HAVE_SYS_BSDTYPES_H
 #include <sys/bsdtypes.h> /* Saul */
@@ -264,6 +265,9 @@ int main(int argc, char **argv)
   fprintf(stderr,"[main]: back from getting window list, looping\n");
 #endif
 
+  if (pledge("stdio", NULL) == -1)
+    err(1, "pledge");
+
   Loop(fd);
   return 0;
 }