72193d0da3
The heavy lifting and final touches were done by Frederic Cambus; this version includes earlier patches, ideas and tweaks from daniel@ and me. ok daniel@, patch and notes from Frederic Cambus (MAINTAINER) Notes : ------- The idea is to avoid using otherwise required 'getpw', 'proc', 'exec' promises entirely. We achieve this by disabling a couple of features, mostly removing obsolete stuff. While we are at it, we attempt to pave the way to be able to remove even more promises in the future, and reduce potential attack vectors. We disable them either at compile time : --disable-bibp-urls --disable-dired --disable-finger Or by hardcoding boolean values to disable the features just before calling pledge and entering main program loop : no_exec = TRUE; no_mail = TRUE; no_shell = TRUE; rlogin_ok = FALSE; telnet_ok = FALSE; Manpage has been updated to mention those restrictions. Also, CFLAGS="-DNOUSERS" was added in the Makefile to disable getpwnam and getpwuid.
50 lines
1.1 KiB
Makefile
50 lines
1.1 KiB
Makefile
# $OpenBSD: Makefile,v 1.24 2016/03/12 14:29:13 tb Exp $
|
|
|
|
V = 2.8.9
|
|
PL = 8
|
|
COMMENT = text web browser
|
|
DISTNAME = lynx${V}dev.${PL}
|
|
PKGNAME = lynx-${V}pl${PL}
|
|
REVISION = 2
|
|
EXTRACT_SUFX = .tar.bz2
|
|
CATEGORIES = www net
|
|
|
|
HOMEPAGE = http://lynx.invisible-island.net/
|
|
|
|
MAINTAINER = Frederic Cambus <fred@statdns.com>
|
|
|
|
# GPLv2 only
|
|
PERMIT_PACKAGE_CDROM = Yes
|
|
|
|
# uses pledge()
|
|
WANTLIB += c crypto ncurses ssl z
|
|
|
|
MASTER_SITES = http://lynx.invisible-island.net/current/ \
|
|
http://invisible-mirror.net/archives/lynx/tarballs/ \
|
|
http://invisible-mirror.net/archives/lynx/patches/
|
|
|
|
CONFIGURE_STYLE = gnu
|
|
CONFIGURE_ARGS = --datarootdir="${PREFIX}/share/doc/lynx" \
|
|
--disable-idna \
|
|
--disable-nls \
|
|
--disable-bibp-urls \
|
|
--disable-dired \
|
|
--disable-finger \
|
|
--enable-default-colors \
|
|
--enable-ipv6 \
|
|
--enable-widec \
|
|
--with-ssl=/usr \
|
|
--with-zlib
|
|
|
|
# This disables most calls to getpw*(3) so we can avoid pledge "getpw".
|
|
CONFIGURE_ENV = CFLAGS="-DNOUSERS"
|
|
|
|
MAKE_FILE = makefile
|
|
|
|
FAKE_FLAGS = SYSCONFDIR="${DESTDIR}${PREFIX}/share/examples/lynx"
|
|
INSTALL_TARGET = install install-help install-doc
|
|
|
|
NO_TEST = Yes
|
|
|
|
.include <bsd.port.mk>
|