unveil(2)

Synopsis

#include <unistd.h>

int unveil(const char *path, const char *permissions);

Rod's take

pledge decides which syscall families you get; unveil decides which parts of the filesystem exist at all. Name the paths with r, w, x or c, then lock it with unveil(NULL, NULL). Anything you didn't name comes back ENOENT, so a popped process can't even confirm /etc/shadow is there; a named path used the wrong way gets EACCES. You can tighten later, never loosen. Stack it with pledge and a daemon is boxed on both axes in an afternoon. Unveil directories rather than single files; programs misbehave badly when their files quietly vanish.

Flags and arguments that matter

Errors you will actually hit

Example

/* privilege-separated worker: docroot only, then lock */
void worker_setup(const char *docroot) {
    if (unveil(docroot, "r") == -1)
        err(1, "unveil docroot");
    if (unveil(NULL, NULL) == -1)
        err(1, "unveil lock");
    if (pledge("stdio rpath inet sendfd", NULL) == -1)
        err(1, "pledge");
}

Trimmed from the full walkthrough in pledge(2) and unveil(2): what OpenBSD figured out that Linux is still catching up to.

Linux equivalent

Linux: Landlock (landlock_create_ruleset(2)) is the closest path-based restriction, though denied paths aren't made invisible. FreeBSD: Capsicum cap_enter(2) with pre-opened directory fds.