get rid of the CGI support

I really want to get rid of the `executor' process hack for CGI scripts
and its escalation to allow fastcgi and proxying to work on non-OpenBSD.

This drops the CGI support and the `executor' process entirely and is
the first step towards gmid 2.0.  It also allows to have more secure
defaults.

On non-OpenBSD systems this means that the sandbox will be deactivated
as soon as fastcgi or proxying are used: you can't open sockets under
FreeBSD' capsicum(4) and I don't want to go thru the pain of making it
work under linux' seccomp/landlock.  Patches are always welcome however.

For folks using CGI scripts (hey, I'm one of you!) not all hope is lost:
fcgiwrap or OpenBSD' slowcgi(8) are ways to run CGI scripts as they were
FastCGI applications.

fixes for the documentation and to the non-OpenBSD sandboxes will
follow.

1 files changed, 1 insertions, 1 deletions

diff --git a/sandbox.c b/sandbox.c
index d221260..45f175d 100644
--- a/sandbox.c
+++ b/sandbox.c
@@ -638,7 +638,7 @@ sandbox_server_process(void)
 		}
 	}
 
-	if (pledge("stdio recvfd rpath inet", NULL) == -1)
+	if (pledge("stdio recvfd rpath inet dns", NULL) == -1)
 		fatal("pledge");
 }