replace pledge "stdio rpath tmppath" with unveil "/tmp" "rwc" to satisfyOPENBSD_7_8

mktemp(3) type operations, unveil "/" "r" for reading all over the tree,
and pledge "stdio rpath wpath cpath" to permit both unveils subject to
their own limitations.

pledge "rpath tmppath" is replace with unveil "/" "r", unveil "/tmp" "rwc",
and "rpath wpath cpath"
from deraadt@; ok semarie

This was using pledge "tmppath" with "rpath wpath cpath".
The "tmppath" is not needed.
from deraadt@; ok semarie and others

uses tmpfile(), which is why it used "tmppath", which is why it now
needs "rpath wpath cpath"
from deraadt@; spotted by brynet

Instead of pledge "tmppath rpath", setup a "rwc" unveil on "/tmp", a
"r" unveil on "/", and then pledge "rpath wpath cpath".
from deraadt@; ok semarie and others

This is using pledge "tmppath" with "rpath wpath cpath".
The "tmppath" is not needed.
from deraadt@; ok semarie and others

These programs are using pledge "tmppath" with "rpath wpath cpath".
The "tmppath" is not needed.
from deraadt@; ok semarie and others

Use unveil() instead of pledge "tmppath".  There is a bit of bulldozering
here to handle the many codeflows regarding output files, and I hope ingo
improves it later.
from deraadt@; Some help with regression validation from job

nc(1) has the more crazy unveil + pledge configuration based upon
argument flags.  I think this correctly replaces "tmppath" with an
unveil.
from deraadt@

Since this program is "rpath wpath cpath", it does not need to use
"tmppath"
from deraadt@; ok op

replace pledge "tmppath" with unveil "/tmp" "rwc" and "rpath wpath cpath".
from deraadt@; ok ok

this is errata/7.8/015_tmppath.patch.sig

1 files changed, 4 insertions, 2 deletions

diff --git a/src/usr.bin/nc/netcat.c b/src/usr.bin/nc/netcat.c
index e3c9c939e2..cb0b3e9cef 100644
--- a/src/usr.bin/nc/netcat.c
+++ b/src/usr.bin/nc/netcat.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: netcat.c,v 1.234 2025/06/24 13:37:11 tb Exp $ */
+/* $OpenBSD: netcat.c,v 1.234.2.1 2026/02/27 20:31:13 bluhm Exp $ */
 /*
  * Copyright (c) 2001 Eric Jackson <ericj@monkey.org>
  * Copyright (c) 2015 Bob Beck.  All rights reserved.
@@ -381,6 +381,8 @@ main(int argc, char *argv[])
                  */
         } else {
                 if (family == AF_UNIX) {
+                        if (unveil("/tmp", "rwc") == -1)
+                                err(1, "unveil /tmp");
                         if (unveil(host, "rwc") == -1)
                                 err(1, "unveil %s", host);
                         if (uflag && !kflag) {
@@ -400,7 +402,7 @@ main(int argc, char *argv[])
         }
 
         if (family == AF_UNIX) {
-                if (pledge("stdio rpath wpath cpath tmppath unix", NULL) == -1)
+                if (pledge("stdio rpath wpath cpath unix", NULL) == -1)
                         err(1, "pledge");
         } else if (Fflag && Pflag) {
                 if (pledge("stdio inet dns sendfd tty", NULL) == -1)