Merge pull request 'strip_exif support for the OpenBSD sandbox' (#548) from oxzi/snac2:strip-metadata-openbsd into master

Reviewed-on: https://codeberg.org/grunfink/snac2/pulls/548

1 files changed, 8 insertions, 1 deletions

diff --git a/sandbox.c b/sandbox.c
index c6cfdcb..15e4622 100644
--- a/sandbox.c
+++ b/sandbox.c
@@ -13,6 +13,8 @@ void sbox_enter(const char *basedir)
         return;
     }
 
+    const xs_val *strip_exif = xs_dict_get(srv_config, "strip_exif");
+
     int smail;
     const char *url = xs_dict_get(srv_config, "smtp_url");
 
@@ -33,6 +35,11 @@ void sbox_enter(const char *basedir)
     if (*address == '/')
         unveil(address, "rwc");
 
+    if (strip_exif) {
+        unveil(xs_dict_get(srv_config, "ffmpeg_path"), "x");
+        unveil(xs_dict_get(srv_config, "mogrify_path"), "x");
+    }
+
     if (smail)
         unveil("/usr/sbin/sendmail",   "x");
 
@@ -45,7 +52,7 @@ void sbox_enter(const char *basedir)
     if (*address == '/')
         p = xs_str_cat(p, " unix");
 
-    if (smail)
+    if (smail || strip_exif)
         p = xs_str_cat(p, " exec");
 
     pledge(p, NULL);