Support OpenBSD 6.0 pledge() syscall for sandboxing.

src/frontend/mosh-server.cc

@@ -33,6 +33,7 @@
 #include "config.h"
 #include "version.h"
 
+#include <err.h>
 #include <errno.h>
 #include <locale.h>
 #include <string.h>
@@ -563,6 +564,15 @@ static int run_server( const char *desired_ip, const char *desired_port,
   } else {
     /* parent */
 
+    /* Drop unnecessary privileges */
+#ifdef HAVE_PLEDGE
+    /* OpenBSD pledge() syscall */
+    if ( pledge( "stdio inet ioctl tty", NULL )) {
+      perror( "pledge() failed" );
+      exit( 1 );
+    }
+#endif
+
 #ifdef HAVE_UTEMPTER
     /* make utmp entry */
     utempter_add_record( master, utmp_entry );

src/frontend/stmclient.cc

@@ -32,6 +32,7 @@
 
 #include "config.h"
 
+#include <err.h>
 #include <errno.h>
 #include <locale.h>
 #include <string.h>
@@ -407,6 +408,15 @@ bool STMClient::main( void )
   /* initialize signal handling and structures */
   main_init();
 
+  /* Drop unnecessary privileges */
+#ifdef HAVE_PLEDGE
+  /* OpenBSD pledge() syscall */
+  if ( pledge( "stdio inet ioctl tty", NULL )) {
+    perror( "pledge() failed" );
+    exit( 1 );
+  }
+#endif
+
   /* prepare to poll for events */
   Select &sel = Select::get_instance();