Roda + Pledge

[citizen428]

Hi, I've spent the past hour or so looking (including here and on the Google group) but I can't find a minimum example/skeleton app for Roda + Pledge. Do you happen to have one?

I have basic familiarity with pledge and unveil but never used them with an actual Ruby web app before, only small test scripts. It would be great to have an example with some best practices, etc. I'm aware of unicorn-lockdown, but at least for now, I'm just looking for a basic Pledge setup for a simple Roda app with Puma.

Thank you!

[jeremyevans]

I use https://github.com/jeremyevans/unicorn-lockdown for running my production applications pledged and unveiled (with unicorn, as the name indicates). I haven't used pledge with puma, so I don't have an example of that. If you need an example how unicorn-lockdown is used in an application, I can provide that.

[citizen428]

Thanks so much for the prompt reply, the example you mention would be much appreciated.

[jeremyevans]

I run https://github.com/jeremyevans/spam locally with unveil + pledge. The unicorn.conf file used isn't in the repository, but it's basically the same one that unicorn-lockdown generates, with the following settings:

  :pledge=>'rpath prot_exec inet unix flock',
  :master_pledge=>'rpath prot_exec cpath wpath inet proc exec',
  :master_execpledge=>'stdio rpath prot_exec inet unix cpath wpath unveil flock',
  :unveil=>{}

The .env.rb used locally has the following code (this isn't directly in the tests):

if ENV['RACK_ENV'] == 'test'
  SPAM_TEST_SETUP = lambda do
    next if ENV['UNUSED_ASSOCIATION_COVERAGE']
    require 'unveiler'
    at_exit{Unveiler.pledge_and_unveil('rpath prot_exec', {})}
  end
end

So when testing, it doesn't unveil anything beyond what unicorn-lockdown unveils by default (just rack, since mail isn't used). It can do this because the application precompiles the assets and precompiles all views, so no file system access to the application is needed at runtime.

Most of my other applications, I don't go to this level of effort by precompiling the views. I usually unveil the views folder with read access.

[citizen428]

This was very helpful, thanks a lot @jeremyevans!