Kernel: Add "accept" pledge promise for accepting incoming connections

This patch adds a new "accept" promise that allows you to call accept()
on an already listening socket. This lets programs set up a socket for
for listening and then dropping "inet" and/or "unix" so that only
incoming (and existing) connections are allowed from that point on.
No new outgoing connections or listening server sockets can be created.

In addition to accept() it also allows getsockopt() with SOL_SOCKET
and SO_PEERCRED, which is used to find the PID/UID/GID of the socket
peer. This is used by our IPC library when creating shared buffers that
should only be accessible to a specific peer process.

This allows us to drop "unix" in WindowServer and LookupServer. :^)

It also makes the debugging/introspection RPC sockets in CEventLoop
based programs work again.

Applications/About/main.cpp

@@ -9,14 +9,14 @@
 
 int main(int argc, char** argv)
 {
- if (pledge("stdio shared_buffer unix rpath cpath fattr", nullptr) < 0) {
+ if (pledge("stdio shared_buffer accept rpath unix cpath fattr", nullptr) < 0) {
  perror("pledge");
  return 1;
  }
 
  GApplication app(argc, argv);
 
- if (pledge("stdio shared_buffer rpath", nullptr) < 0) {
+ if (pledge("stdio shared_buffer accept rpath", nullptr) < 0) {
  perror("pledge");
  return 1;
  }

Applications/Browser/main.cpp

@@ -30,7 +30,7 @@ static const char* home_url = "file:https:///home/anon/www/welcome.html";
 
 int main(int argc, char** argv)
 {
- if (pledge("stdio unix shared_buffer cpath rpath fattr", nullptr) < 0) {
+ if (pledge("stdio shared_buffer accept unix cpath rpath fattr", nullptr) < 0) {
  perror("pledge");
  return 1;
  }
@@ -40,7 +40,7 @@ int main(int argc, char** argv)
  // Connect to the ProtocolServer immediately so we can drop the "unix" pledge.
  ResourceLoader::the();
 
- if (pledge("stdio shared_buffer rpath", nullptr) < 0) {
+ if (pledge("stdio shared_buffer accept rpath", nullptr) < 0) {
  perror("pledge");
  return 1;
  }

Applications/Calculator/main.cpp

@@ -9,14 +9,14 @@
 
 int main(int argc, char** argv)
 {
- if (pledge("stdio shared_buffer unix rpath cpath fattr", nullptr) < 0) {
+ if (pledge("stdio shared_buffer rpath accept unix cpath fattr", nullptr) < 0) {
  perror("pledge");
  return 1;
  }
 
  GApplication app(argc, argv);
 
- if (pledge("stdio shared_buffer rpath", nullptr) < 0) {
+ if (pledge("stdio shared_buffer rpath accept", nullptr) < 0) {
  perror("pledge");
  return 1;
  }

Applications/DisplayProperties/main.cpp

@@ -12,14 +12,14 @@
 
 int main(int argc, char** argv)
 {
- if (pledge("stdio shared_buffer unix rpath cpath wpath fattr", nullptr) < 0) {
+ if (pledge("stdio shared_buffer rpath accept unix cpath wpath fattr", nullptr) < 0) {
  perror("pledge");
  return 1;
  }
 
  GApplication app(argc, argv);
 
- if (pledge("stdio shared_buffer rpath cpath wpath", nullptr) < 0) {
+ if (pledge("stdio shared_buffer rpath accept cpath wpath", nullptr) < 0) {
  perror("pledge");
  return 1;
  }

Applications/FileManager/main.cpp

@@ -31,7 +31,7 @@
 
 int main(int argc, char** argv)
 {
- if (pledge("stdio thread unix shared_buffer cpath rpath wpath fattr proc exec", nullptr) < 0) {
+ if (pledge("stdio thread shared_buffer accept unix cpath rpath wpath fattr proc exec", nullptr) < 0) {
  perror("pledge");
  return 1;
  }
@@ -50,7 +50,7 @@ int main(int argc, char** argv)
 
  GApplication app(argc, argv);
 
- if (pledge("stdio thread shared_buffer cpath rpath wpath fattr proc exec", nullptr) < 0) {
+ if (pledge("stdio thread shared_buffer accept cpath rpath wpath fattr proc exec", nullptr) < 0) {
  perror("pledge");
  return 1;
  }

Applications/FontEditor/main.cpp

@@ -9,14 +9,14 @@
 
 int main(int argc, char** argv)
 {
- if (pledge("stdio shared_buffer unix rpath cpath wpath fattr", nullptr) < 0) {
+ if (pledge("stdio shared_buffer rpath accept unix cpath wpath fattr", nullptr) < 0) {
  perror("pledge");
  return 1;
  }
 
  GApplication app(argc, argv);
 
- if (pledge("stdio shared_buffer rpath cpath wpath", nullptr) < 0) {
+ if (pledge("stdio shared_buffer rpath accept cpath wpath", nullptr) < 0) {
  perror("pledge");
  return 1;
  }

Applications/Help/main.cpp

@@ -24,14 +24,14 @@
 
 int main(int argc, char* argv[])
 {
- if (pledge("stdio unix shared_buffer cpath rpath fattr", nullptr) < 0) {
+ if (pledge("stdio shared_buffer accept rpath unix cpath fattr", nullptr) < 0) {
  perror("pledge");
  return 1;
  }
 
  GApplication app(argc, argv);
 
- if (pledge("stdio shared_buffer rpath", nullptr) < 0) {
+ if (pledge("stdio shared_buffer accept rpath", nullptr) < 0) {
  perror("pledge");
  return 1;
  }

Applications/HexEditor/main.cpp

@@ -4,14 +4,14 @@
 
 int main(int argc, char** argv)
 {
- if (pledge("stdio shared_buffer unix rpath cpath wpath fattr", nullptr) < 0) {
+ if (pledge("stdio shared_buffer accept rpath unix cpath wpath fattr", nullptr) < 0) {
  perror("pledge");
  return 1;
  }
 
  GApplication app(argc, argv);
 
- if (pledge("stdio shared_buffer rpath cpath wpath", nullptr) < 0) {
+ if (pledge("stdio shared_buffer accept rpath cpath wpath", nullptr) < 0) {
  perror("pledge");
  return 1;
  }

Applications/PaintBrush/main.cpp

@@ -15,14 +15,14 @@
 
 int main(int argc, char** argv)
 {
- if (pledge("stdio shared_buffer unix rpath wpath cpath fattr", nullptr) < 0) {
+ if (pledge("stdio shared_buffer accept rpath unix wpath cpath fattr", nullptr) < 0) {
  perror("pledge");
  return 1;
  }
 
  GApplication app(argc, argv);
 
- if (pledge("stdio shared_buffer rpath wpath cpath", nullptr) < 0) {
+ if (pledge("stdio shared_buffer accept rpath wpath cpath", nullptr) < 0) {
  perror("pledge");
  return 1;
  }

Applications/QuickShow/main.cpp

@@ -11,14 +11,14 @@
 
 int main(int argc, char** argv)
 {
- if (pledge("stdio unix shared_buffer rpath cpath fattr", nullptr) < 0) {
+ if (pledge("stdio shared_buffer accept rpath unix cpath fattr", nullptr) < 0) {
  perror("pledge");
  return 1;
  }
 
  GApplication app(argc, argv);
 
- if (pledge("stdio shared_buffer rpath", nullptr) < 0) {
+ if (pledge("stdio shared_buffer accept rpath", nullptr) < 0) {
  perror("pledge");
  return 1;
  }

Applications/SoundPlayer/main.cpp

@@ -12,22 +12,22 @@
 
 int main(int argc, char** argv)
 {
- if (pledge("stdio unix shared_buffer cpath rpath fattr", nullptr) < 0) {
+ if (pledge("stdio shared_buffer accept rpath unix cpath fattr", nullptr) < 0) {
  perror("pledge");
  return 1;
  }
 
  GApplication app(argc, argv);
 
- if (pledge("stdio unix shared_buffer rpath", nullptr) < 0) {
+ if (pledge("stdio shared_buffer accept rpath unix", nullptr) < 0) {
  perror("pledge");
  return 1;
  }
 
  auto audio_client = AClientConnection::construct();
  audio_client->handshake();
 
- if (pledge("stdio shared_buffer rpath", nullptr) < 0) {
+ if (pledge("stdio shared_buffer accept rpath", nullptr) < 0) {
  perror("pledge");
  return 1;
  }

Applications/SystemMonitor/main.cpp

@@ -49,14 +49,14 @@ static NonnullRefPtr<GWidget> build_graphs_tab();
 
 int main(int argc, char** argv)
 {
- if (pledge("stdio proc shared_buffer rpath unix cpath fattr", nullptr) < 0) {
+ if (pledge("stdio proc shared_buffer accept rpath unix cpath fattr", nullptr) < 0) {
  perror("pledge");
  return 1;
  }
 
  GApplication app(argc, argv);
 
- if (pledge("stdio proc shared_buffer rpath", nullptr) < 0) {
+ if (pledge("stdio proc shared_buffer accept rpath", nullptr) < 0) {
  perror("pledge");
  return 1;
  }

Applications/Taskbar/main.cpp

@@ -5,14 +5,14 @@
 
 int main(int argc, char** argv)
 {
- if (pledge("stdio shared_buffer proc exec rpath unix cpath fattr", nullptr) < 0) {
+ if (pledge("stdio shared_buffer accept proc exec rpath unix cpath fattr", nullptr) < 0) {
  perror("pledge");
  return 1;
  }
 
  GApplication app(argc, argv);
 
- if (pledge("stdio shared_buffer proc exec rpath", nullptr) < 0) {
+ if (pledge("stdio shared_buffer accept proc exec rpath", nullptr) < 0) {
  perror("pledge");
  return 1;
  }

Applications/Terminal/main.cpp

@@ -136,7 +136,7 @@ RefPtr<GWindow> create_settings_window(TerminalWidget& terminal, RefPtr<CConfigF
 
 int main(int argc, char** argv)
 {
- if (pledge("stdio tty rpath cpath wpath shared_buffer proc exec unix fattr", nullptr) < 0) {
+ if (pledge("stdio tty rpath accept cpath wpath shared_buffer proc exec unix fattr", nullptr) < 0) {
  perror("pledge");
  return 1;
  }
@@ -153,7 +153,7 @@ int main(int argc, char** argv)
 
  GApplication app(argc, argv);
 
- if (pledge("stdio tty rpath cpath wpath shared_buffer proc exec", nullptr) < 0) {
+ if (pledge("stdio tty rpath accept cpath wpath shared_buffer proc exec", nullptr) < 0) {
  perror("pledge");
  return 1;
  }

Applications/TextEditor/main.cpp

@@ -4,14 +4,14 @@
 
 int main(int argc, char** argv)
 {
- if (pledge("stdio rpath cpath wpath shared_buffer unix fattr", nullptr) < 0) {
+ if (pledge("stdio rpath accept cpath wpath shared_buffer unix fattr", nullptr) < 0) {
  perror("pledge");
  return 1;
  }
 
  GApplication app(argc, argv);
 
- if (pledge("stdio rpath cpath wpath shared_buffer", nullptr) < 0) {
+ if (pledge("stdio rpath accept cpath wpath shared_buffer", nullptr) < 0) {
  perror("pledge");
  return 1;
  }

Base/usr/share/man/man2/pledge.md

@@ -34,6 +34,7 @@ If `promises` or `execpromises` is null, the corresponding value is unchanged.
 * `exec`: The [`exec(2)`](exec.md) syscall
 * `unix`: UNIX local domain sockets
 * `inet`: IPv4 domain sockets
+* `accept`: May use [`accept(2)`](accept.md) to accept incoming socket connections on already listening sockets. It also allows [`getsockopt(2)`](getsockopt.md) with `SOL_SOCKET` and `SO_PEERCRED` on local sockets
 * `rpath`: "Read" filesystem access
 * `wpath`: "Write" filesystem access
 * `cpath`: "Create" filesystem access

DevTools/HackStudio/main.cpp

@@ -97,14 +97,14 @@ bool make_is_available();
 
 int main(int argc, char** argv)
 {
- if (pledge("stdio tty rpath cpath wpath shared_buffer proc exec unix fattr", nullptr) < 0) {
+ if (pledge("stdio tty accept rpath cpath wpath shared_buffer proc exec unix fattr", nullptr) < 0) {
  perror("pledge");
  return 1;
  }
 
  GApplication app(argc, argv);
 
- if (pledge("stdio tty rpath cpath wpath shared_buffer proc exec fattr", nullptr) < 0) {
+ if (pledge("stdio tty accept rpath cpath wpath shared_buffer proc exec fattr", nullptr) < 0) {
  perror("pledge");
  return 1;
  }

Games/Minesweeper/main.cpp

@@ -14,14 +14,14 @@
 
 int main(int argc, char** argv)
 {
- if (pledge("stdio rpath wpath cpath shared_buffer unix fattr", nullptr) < 0) {
+ if (pledge("stdio rpath accept wpath cpath shared_buffer unix fattr", nullptr) < 0) {
  perror("pledge");
  return 1;
  }
 
  GApplication app(argc, argv);
 
- if (pledge("stdio rpath wpath cpath shared_buffer", nullptr) < 0) {
+ if (pledge("stdio rpath accept wpath cpath shared_buffer", nullptr) < 0) {
  perror("pledge");
  return 1;
  }

Games/Snake/main.cpp

@@ -12,14 +12,14 @@
 
 int main(int argc, char** argv)
 {
- if (pledge("stdio rpath cpath shared_buffer unix fattr", nullptr) < 0) {
+ if (pledge("stdio rpath shared_buffer accept cpath unix fattr", nullptr) < 0) {
  perror("pledge");
  return 1;
  }
 
  GApplication app(argc, argv);
 
- if (pledge("stdio rpath shared_buffer", nullptr) < 0) {
+ if (pledge("stdio rpath shared_buffer accept", nullptr) < 0) {
  perror("pledge");
  return 1;
  }

Kernel/Process.cpp

@@ -3091,6 +3091,7 @@ int Process::sys$listen(int sockfd, int backlog)
 
 int Process::sys$accept(int accepting_socket_fd, sockaddr* address, socklen_t* address_size)
 {
+ REQUIRE_PROMISE(accept);
  if (!validate_write_typed(address_size))
  return -EFAULT;
  SmapDisabler disabler;
@@ -3105,7 +3106,6 @@ int Process::sys$accept(int accepting_socket_fd, sockaddr* address, socklen_t* a
  if (!accepting_socket_description->is_socket())
  return -ENOTSOCK;
  auto& socket = *accepting_socket_description->socket();
- REQUIRE_PROMISE_FOR_SOCKET_DOMAIN(socket.domain());
  if (!socket.can_accept()) {
  if (accepting_socket_description->is_blocking()) {
  if (current->block<Thread::AcceptBlocker>(*accepting_socket_description) != Thread::BlockResult::WokeNormally)
@@ -3348,7 +3348,12 @@ int Process::sys$getsockopt(const Syscall::SC_getsockopt_params* params)
  if (!description->is_socket())
  return -ENOTSOCK;
  auto& socket = *description->socket();
- REQUIRE_PROMISE_FOR_SOCKET_DOMAIN(socket.domain());
+
+ if (has_promised(Pledge::accept) && socket.is_local() && level == SOL_SOCKET && option == SO_PEERCRED) {
+ // We make an exception for SOL_SOCKET::SO_PEERCRED on local sockets if you've pledged "accept"
+ } else {
+ REQUIRE_PROMISE_FOR_SOCKET_DOMAIN(socket.domain());
+ }
  return socket.getsockopt(*description, level, option, value, value_size);
 }
 

Kernel/Process.h

@@ -47,6 +47,7 @@ extern VirtualAddress g_return_to_ring3_from_signal_trampoline;
  __ENUMERATE_PLEDGE_PROMISE(chroot) \
  __ENUMERATE_PLEDGE_PROMISE(thread) \
  __ENUMERATE_PLEDGE_PROMISE(video) \
+ __ENUMERATE_PLEDGE_PROMISE(accept) \
  __ENUMERATE_PLEDGE_PROMISE(shared_buffer)
 
 enum class Pledge : u32 {

MenuApplets/Audio/main.cpp

@@ -49,14 +49,14 @@ class AudioWidget final : public GWidget {
 
 int main(int argc, char** argv)
 {
- if (pledge("stdio shared_buffer rpath unix cpath fattr", nullptr) < 0) {
+ if (pledge("stdio shared_buffer accept rpath unix cpath fattr", nullptr) < 0) {
  perror("pledge");
  return 1;
  }
 
  GApplication app(argc, argv);
 
- if (pledge("stdio shared_buffer rpath unix", nullptr) < 0) {
+ if (pledge("stdio shared_buffer accept rpath unix", nullptr) < 0) {
  perror("pledge");
  return 1;
  }
@@ -70,7 +70,7 @@ int main(int argc, char** argv)
  window->set_main_widget(widget);
  window->show();
 
- if (pledge("stdio shared_buffer rpath", nullptr) < 0) {
+ if (pledge("stdio shared_buffer accept rpath", nullptr) < 0) {
  perror("pledge");
  return 1;
  }