M backend.go → backend.go

@@ -135,8 +135,6 @@ }
 	return res.Image, nil
 }
 
-var backendhooks []func()
-
 func orphancheck() {
 	var b [1]byte
 	os.Stdin.Read(b[:])
@@ -169,9 +167,7 @@ err = setLimits()
 	if err != nil {
 		elog.Printf("error setting backend limits: %s", err)
 	}
-	for _, h := range backendhooks {
-		h()
-	}
+	securitizebackend()
 	srv.Accept(lis)
 }
 

M unveil.go → unveil.go

@@ -19,35 +19,34 @@ import (
 	"humungus.tedunangst.com/r/pledge"
 )
 
-func init() {
-	preservehooks = append(preservehooks, func() {
-		err := pledge.Unveil("/etc/ssl", "r")
+func securitizeweb() {
+	err := pledge.Unveil("/etc/ssl", "r")
+	if err != nil {
+		elog.Fatalf("unveil(%s, %s) failure (%d)", "/etc/ssl", "r", err)
+	}
+	if viewDir != dataDir {
+		err = pledge.Unveil(viewDir, "r")
 		if err != nil {
-			elog.Fatalf("unveil(%s, %s) failure (%d)", "/etc/ssl", "r", err)
+			elog.Fatalf("unveil(%s, %s) failure (%d)", viewDir, "r", err)
 		}
-		if viewDir != dataDir {
-			err = pledge.Unveil(viewDir, "r")
-			if err != nil {
-				elog.Fatalf("unveil(%s, %s) failure (%d)", viewDir, "r", err)
-			}
-		}
-		err = pledge.Unveil(dataDir, "rwc")
-		if err != nil {
-			elog.Fatalf("unveil(%s, %s) failure (%d)", dataDir, "rwc", err)
-		}
-		pledge.UnveilEnd()
-		promises := "stdio rpath wpath cpath flock dns inet unix"
-		err = pledge.Pledge(promises)
-		if err != nil {
-			elog.Fatalf("pledge(%s) failure (%d)", promises, err)
-		}
-	})
-	backendhooks = append(backendhooks, func() {
-		pledge.UnveilEnd()
-		promises := "stdio unix"
-		err := pledge.Pledge(promises)
-		if err != nil {
-			elog.Fatalf("pledge(%s) failure (%d)", promises, err)
-		}
-	})
+	}
+	err = pledge.Unveil(dataDir, "rwc")
+	if err != nil {
+		elog.Fatalf("unveil(%s, %s) failure (%d)", dataDir, "rwc", err)
+	}
+	pledge.UnveilEnd()
+	promises := "stdio rpath wpath cpath flock dns inet unix"
+	err = pledge.Pledge(promises)
+	if err != nil {
+		elog.Fatalf("pledge(%s) failure (%d)", promises, err)
+	}
+}
+
+func securitizebackend() {
+	pledge.UnveilEnd()
+	promises := "stdio unix"
+	err := pledge.Pledge(promises)
+	if err != nil {
+		elog.Fatalf("pledge(%s) failure (%d)", promises, err)
+	}
 }

M web.go → web.go

@@ -2696,8 +2696,6 @@ ilog.Printf("apocalypse")
 	os.Exit(0)
 }
 
-var preservehooks []func()
-
 func bgmonitor() {
 	for {
 		when := time.Now().Add(-3 * 24 * time.Hour).UTC().Format(dbtimeformat)
@@ -2814,9 +2812,7 @@ }
 		loadAvatarColors()
 	}
 
-	for _, h := range preservehooks {
-		h()
-	}
+	securitizeweb()
 
 	mux := mux.NewRouter()
 	mux.Use(addcspheaders)