OpenBSD Web Documentation

OpenBSD provides two primary mechanisms for sandboxing processes to limit their capabilities and access to system resources:

• pledge(promises): Limits the system calls a process can make. Once a promise is made, it can only be tightened (restricted), never widened. Calling pledge("") restricts the process to only computation on memory shared with another process. Violating a promise results in a SIGABRT.
• unveil(path, mode): Limits the filesystem paths a process can see and access. The mode specifies access levels (e.g., r for read, w for write, c for create). Calling unveil(NULL, NULL) prevents any further changes to the unveiled filesystem view. Violating an unveil restriction results in ENOENT or EACCESS errors.

These tools are used to prevent unwanted access to sensitive files like ~/.ssh, GPG keys, or /etc/master.passwd.

To determine the correct pledge() promises and unveil() paths for a program, use the ktrace utility. This allows you to observe:

1. Syscalls used: Map these to the appropriate pledge() promise classes.
2. Files accessed: Map these to the necessary unveil() paths and access modes.

Iterate this process by applying restrictions and checking for crashes until the program runs correctly within the defined sandbox.

By default, Firefox on OpenBSD restricts filesystem access. If you need to use external MIME handlers (e.g., opening a PDF in mupdf or a document in soffice), you must add them to the unveil.main configuration.

Refer to /usr/local/share/doc/pkg-readmes/firefox for specific instructions on how to add these paths.

To package a new Mozilla beta or release version, follow this workflow within the port directory. This process involves updating the version, adjusting dependencies, managing patches, and uploading the package.

1. Update MOZILLA_VERSION and adjust dependencies in the Makefile.
2. Generate the makesum file.
3. Apply patches.
4. If patches need to be fixed, removed, or added, use make update-patches.
5. Update the plist.
6. Run a dependency check for libraries.
7. Build the package.
8. Upload the package using pkg_upload.
9. Commit the changes (Makefile and distinfo) to your version control system.

# Change MOZILLA_VERSION, adjust deps
make makesum
make patch

# fix/rm/add patches if needed
make update-patches
make update-plist
make port-lib-depends-check
make package
pkg_upload
git commit -m 'XX.0bY' Makefile distinfo
git push

If you are developing for or troubleshooting Firefox on OpenBSD, you can inspect the sandbox initialization by setting the following environment variable:

MOZ_LOG=OpenBSDSandbox:5

This will print the unveil() and pledge() calls made at process startup to the logs.

When using pledge(), you specify subsets of syscalls. Common promise classes include:

• stdio: Standard I/O operations.
• rpath, cpath, wpath, tmppath: Filesystem access related to reading, creating, writing, or temporary paths.
• inet, dns, unix: Networking capabilities.
• exec, proc: Process management.
• video, audio, drm: Multimedia and device access.
• prot_exec: Memory protection/execution.
• getpw: User information access.