From: Claudio Jeker <cjeker@diehard.n-r-g.com>
Subject: Re: pkgconf 3.0.5
To: Theo Buehler <tb@theobuehler.org>
Cc: tech@openbsd.org
Date: Thu, 6 Aug 2026 08:54:12 +0200

On Thu, Aug 06, 2026 at 08:07:58AM +0200, Theo Buehler wrote:
> On Thu, Aug 06, 2026 at 07:56:44AM +0200, Theo Buehler wrote:
> >                                           I have added a small patch
> > to modify the unveil code to do a single unveil("/", "r") in
> > unveil_search_paths() instead of fine-grained iterations over files and
> > directories that need to be readable. pkgconf usually runs as a normal
> > user with stdio rpath wpath cpath and locked unveil. Only /dev/null and
> > an optional log file have "rwc".

Yes, that is more sensible. It looks like their code would add potentially
many paths which does not fare well with the small limit of unveil entries
the system enforces.

> This is the patch:
> 
> diff --git a/usr.bin/pkgconf/cli/core.c b/usr.bin/pkgconf/cli/core.c
> index a24e9ca1eb5..3f70f20d45b 100644
> --- a/usr.bin/pkgconf/cli/core.c
> +++ b/usr.bin/pkgconf/cli/core.c
> @@ -939,20 +939,7 @@ unveil_search_paths(pkgconf_client_t *client, const pkgconf_cross_personality_t
>  	pkgconf_node_t *n;
>  
>  	client->unveil_handler(client, "/dev/null", "rwc");
> -
> -	PKGCONF_FOREACH_LIST_ENTRY(client->dir_list.head, n)
> -	{
> -		pkgconf_path_t *pn = n->data;
> -
> -		client->unveil_handler(client, pn->path, "r");
> -	}
> -
> -	PKGCONF_FOREACH_LIST_ENTRY(personality->dir_list.head, n)
> -	{
> -		pkgconf_path_t *pn = n->data;
> -
> -		client->unveil_handler(client, pn->path, "r");
> -	}
> +	client->unveil_handler(client, "/", "r");
>  }
>  
>  static bool
> diff --git a/usr.bin/pkgconf/libpkgconf/pkg.c b/usr.bin/pkgconf/libpkgconf/pkg.c
> index a761cdd4ae7..65deb89f03d 100644
> --- a/usr.bin/pkgconf/libpkgconf/pkg.c
> +++ b/usr.bin/pkgconf/libpkgconf/pkg.c
> @@ -1154,17 +1154,11 @@ pkgconf_pkg_find(pkgconf_client_t *client, const char *name)
>  	/* name might actually be a filename. */
>  	if (str_has_suffix(name, PKG_CONFIG_EXT))
>  	{
> -		if (client->unveil_handler != NULL)
> -			client->unveil_handler(client, name, "r");
> -
>  		pkg = pkgconf_pkg_new_from_path(client, name, 0);
>  		if (pkg != NULL)
>  		{
>  			PKGCONF_TRACE(client, "%s is a file", name);
>  
> -			if (client->unveil_handler != NULL)
> -				client->unveil_handler(client, pkg->pc_filedir, "r");
> -
>  			pkgconf_path_add(pkg->pc_filedir, &client->dir_list, true);
>  			goto out;
>  		}
> 

-- 
:wq Claudio