initial pledge(2) on OpenBSD

[klemensn]

Limit the set of system calls shairport-sync is allowed to make, most importantly fork(2)/execve(2) if and only if user defined commands are run.

OpenBSD's official audio/shairport-sync port already ships with this patch.

https://man.openbsd.org/pledge.2

[klemensn]

Here's what already works and has already been tested by other OpenBSD users.

#if defined(__OpenBSD__) vs. #ifdef COMPILE_FOR_OPENBSD, #ifdef FEATURE / if (config) dances and comments/wording aside, this PR is fit for merge while my idea is to rebase #1801 onto it.

[klemensn]

I've also tested this with AirPlay 2 Support and mikebrady/nqptp#31, i.e. shared memory between the two unprivileged and pledged programs does work and sound is played.

[mikebrady]

Thanks again for all this work! I’ll try it out with the (patched) NQPTP.

[klemensn]

Thanks again for all this work! I’ll try it out with the (patched) NQPTP.

If it helps, https://github.com/jasperla/openbsd-wip/tree/master/net/nqptp is a ready-to-use NQPTP port incl. this PR,
so if you're familiar with ports(7) this is all you need

cd .../net/nqptp
make install
rcctl start nqptp

Then tweak https://github.com/openbsd/ports/tree/master/audio/shairport-sync to build with AirPlay 2 and do

cd .../audio/shairport-sync
make install
[follow the readme]
rcctl start shairport-sync

[klemensn]

Friendly ping.

[mikebrady]

Oops — I think I misunderstood, and was leaving the PRs open.

Please let me know what you’d like me to do — accept the two PRs, or what.

Thanks.

[klemensn]

Oops — I think I misunderstood, and was leaving the PRs open.

Please let me know what you’d like me to do — accept the two PRs, or what.

Thanks.

This PR

Here's what already works and has already been tested by other OpenBSD users.

It is ready for review/merge -- the other remains a draft I can work with later on.

[mikebrady]

Many thanks for this!