3 ms·

tame() is one of those things that is so simple and obvious in retrospect that it's flabbergasting that it took so long to be invented/(re)discovered.

by phpnode 11y ago

vezzy-fnord 11y ago
Probably because it's theoretically inelegant. A lot of people are quite absolutist when it comes to security, and shun solutions that aren't entirely robust to all possible edge cases. Yet in practice, tame(2) makes privilege dropping such a trivial activity that it will quite likely influence far more programmers than a more capable but also more grueling and complex mechanism like seccomp-bpf. Speaking of which, here's a tame(2)-like wrapper over libseccomp: https://github.com/dimkr/libwaive https://github.com/dimkr/libwaive
- gnuvince 11y ago
  Quoting myself from the lobste.rs thread[0]: >> No matter how good the interface is, it’s almost certain this will never hit Linux in the next 5-10 years. It’s not because the interface is bad, but because the glibc-devs and other people are scared of simple and straight-forward interfaces, rather not doing anything than implementing an interface which handles the general case rather than trying to cover the 0.5% of edge cases, being complex and bloated. > This is such a tough lesson to learn and to apply. I still fail at it most of the time in my own code, thinking up the weirdest edge cases possible that I need to handle rather than making the 99% case nice and simple. I'm a CS grad student, I've worked in the industry before, and I am 100% guilty of sometimes dismissing a nice and simple solution because the perfectionist in me is annoyed that an edge case takes O(n^2) or that the algorithm won't give the optimal answer in some pretty rare circumstances. [0] https://lobste.rs/s/4jlaod/tame_-_bad_kitty_no_socket_for_you https://lobste.rs/s/4jlaod/tame_-_bad_kitty_no_socket_for_yo...
binarycrusader 11y ago
Solaris has had this capability for many years: http://docs.oracle.com/cd/E23824_01/html/821-1456/prbac-2.html http://docs.oracle.com/cd/E23824_01/html/821-1456/prbac-2.ht... https://blogs.oracle.com/casper/entry/solaris_privileges https://blogs.oracle.com/casper/entry/solaris_privileges http://www.oracle.com/technetwork/systems/hands-on-labs/s11-security-1408641.html http://www.oracle.com/technetwork/systems/hands-on-labs/s11-...

tame() is one of those things that is so simple and obvious in retrospect that it's flabbergasting that it took so long to be invented/(re)discovered.

by phpnode 11y ago

tame() is one of those things that is so simple and obvious in retrospect that it's flabbergasting that it took so long to be invented/(re)discovered.

vezzy-fnord 11y ago

Probably because it's theoretically inelegant. A lot of people are quite absolutist when it comes to security, and shun solutions that aren't entirely robust to all possible edge cases. Yet in practice, tame(2) makes privilege dropping such a trivial activity that it will quite likely influence far more programmers than a more capable but also more grueling and complex mechanism like seccomp-bpf. Speaking of which, here's a tame(2)-like wrapper over libseccomp: https://github.com/dimkr/libwaive https://github.com/dimkr/libwaive

gnuvince 11y ago
Quoting myself from the lobste.rs thread[0]: >> No matter how good the interface is, it’s almost certain this will never hit Linux in the next 5-10 years. It’s not because the interface is bad, but because the glibc-devs and other people are scared of simple and straight-forward interfaces, rather not doing anything than implementing an interface which handles the general case rather than trying to cover the 0.5% of edge cases, being complex and bloated. > This is such a tough lesson to learn and to apply. I still fail at it most of the time in my own code, thinking up the weirdest edge cases possible that I need to handle rather than making the 99% case nice and simple. I'm a CS grad student, I've worked in the industry before, and I am 100% guilty of sometimes dismissing a nice and simple solution because the perfectionist in me is annoyed that an edge case takes O(n^2) or that the algorithm won't give the optimal answer in some pretty rare circumstances. [0] https://lobste.rs/s/4jlaod/tame_-_bad_kitty_no_socket_for_you https://lobste.rs/s/4jlaod/tame_-_bad_kitty_no_socket_for_yo...

binarycrusader 11y ago

Solaris has had this capability for many years: http://docs.oracle.com/cd/E23824_01/html/821-1456/prbac-2.html http://docs.oracle.com/cd/E23824_01/html/821-1456/prbac-2.ht... https://blogs.oracle.com/casper/entry/solaris_privileges https://blogs.oracle.com/casper/entry/solaris_privileges http://www.oracle.com/technetwork/systems/hands-on-labs/s11-security-1408641.html http://www.oracle.com/technetwork/systems/hands-on-labs/s11-...