Add pledge(2) and unveil(2) sandboxing for tp and tpd

tpd: unveil data dir (rwc), resolv.conf (r) when DNS needed,
then pledge stdio rpath wpath cpath fattr inet unix dns.

tp: unveil socket path (rw), then pledge stdio unix rpath.

1 files changed, 7 insertions, 0 deletions

diff --git a/src/bin/tp.rs b/src/bin/tp.rs
index e33c357..860d1c9 100644
--- a/src/bin/tp.rs
+++ b/src/bin/tp.rs
@@ -10,6 +10,8 @@ use std::path::PathBuf;
 
 #[path = "../base58.rs"]
 mod base58;
+#[path = "../sandbox.rs"]
+mod sandbox;
 
 fn default_socket() -> PathBuf {
     PathBuf::from("/var/tesseras-paste/daemon.sock")
@@ -157,6 +159,11 @@ fn main() {
         }
     };
 
+    // ── Sandbox ─────────────────────────────────────
+    sandbox::do_unveil(&sock_path, "rw");
+    sandbox::unveil_lock();
+    sandbox::do_pledge("stdio unix rpath");
+
     let stream = match UnixStream::connect(&sock_path) {
         Ok(s) => s,
         Err(e) => {