5 ms·

I thoroughly enjoyed Theo de Raadt recent talk, "Pledge: A new security technology in openbsd". It left me itching to try OpenBSD. "Pledge() is designed as a m

by lloydde 11y ago

I thoroughly enjoyed Theo de Raadt recent talk, "Pledge: A new security technology in openbsd". It left me itching to try OpenBSD. "Pledge() is designed as a mitigation rather than a cure-all, de Raadt explains, but it's a mitigation with an interesting approach: a process or application stipulates the system services it needs, and if it steps beyond its boundaries, it's killed." http://www.theregister.co.uk/2015/11/10/untamed_pledge_hopes_to_improve_openbsd_security/ http://www.theregister.co.uk/2015/11/10/untamed_pledge_hopes... Hackfest 2015: Theo de Raadt presented "Pledge: A new security technology in openbsd" video: https://www.youtube.com/watch?v=F_7S1eqKsFk https://www.youtube.com/watch?v=F_7S1eqKsFk slides: http://www.openbsd.org/papers/hackfest2015-pledge/index.html http://www.openbsd.org/papers/hackfest2015-pledge/index.html

masklinn 11y ago
Note for those who don't really follow, pledge(2) is the System Call Formerly Know As tame(2).
rlpb 11y ago
This sounds exactly like seccomp and seccomp-bpf in Linux, so I don't think the feature is special to OpenBSD. Chrome uses it, for example. From https://wiki.mozilla.org/Security/Sandbox/Seccomp#Intro_to_seccomp_and_seccomp-bpf https://wiki.mozilla.org/Security/Sandbox/Seccomp#Intro_to_s... "Seccomp stands for secure computing mode. It's a simple sandboxing tool in the Linux kernel, available since Linux version 2.6.12. When enabling seccomp, the process enters a "secure mode" where a very small number of system calls are available (exit(), read(), write(), sigreturn()). Writing code to work in this environment is difficult; for example, dynamic memory allocation (using brk() or mmap(), either directly or to implement malloc()) is not possible. Seccomp-BPF is a more recent extension to seccomp, which allows filtering system calls with BPF (Berkeley Packet Filter) programs. These filters can be used to allow or deny an arbitrary set of system calls, as well as filter on system call arguments (numeric values only; pointer arguments can't be dereferenced)"
- allep 11y ago
  Pledge is much easier to user that seccomp-bpf and is now forced in more than half of the binary distribuited in the base system. Also, there is a big difference between having a technology and enforcing the technology: Seccomp has been included in linux for a very long time, but is ignored by most developers and not used except in specific instances (ie chrome as you pointed out)
- cuckcuckspruce 11y ago
  ...and the slides and linked presentation address this. Here is the slide: http://www.openbsd.org/papers/hackfest2015-pledge/mgp00011.html http://www.openbsd.org/papers/hackfest2015-pledge/mgp00011.h... And here is a link into the presentation video: https://youtu.be/F_7S1eqKsFk?t=13m2s https://youtu.be/F_7S1eqKsFk?t=13m2s

by lloydde 11y ago

masklinn 11y ago

Note for those who don't really follow, pledge(2) is the System Call Formerly Know As tame(2).

rlpb 11y ago

This sounds exactly like seccomp and seccomp-bpf in Linux, so I don't think the feature is special to OpenBSD. Chrome uses it, for example. From https://wiki.mozilla.org/Security/Sandbox/Seccomp#Intro_to_seccomp_and_seccomp-bpf https://wiki.mozilla.org/Security/Sandbox/Seccomp#Intro_to_s... "Seccomp stands for secure computing mode. It's a simple sandboxing tool in the Linux kernel, available since Linux version 2.6.12. When enabling seccomp, the process enters a "secure mode" where a very small number of system calls are available (exit(), read(), write(), sigreturn()). Writing code to work in this environment is difficult; for example, dynamic memory allocation (using brk() or mmap(), either directly or to implement malloc()) is not possible. Seccomp-BPF is a more recent extension to seccomp, which allows filtering system calls with BPF (Berkeley Packet Filter) programs. These filters can be used to allow or deny an arbitrary set of system calls, as well as filter on system call arguments (numeric values only; pointer arguments can't be dereferenced)"

allep 11y ago
Pledge is much easier to user that seccomp-bpf and is now forced in more than half of the binary distribuited in the base system. Also, there is a big difference between having a technology and enforcing the technology: Seccomp has been included in linux for a very long time, but is ignored by most developers and not used except in specific instances (ie chrome as you pointed out)
cuckcuckspruce 11y ago
...and the slides and linked presentation address this. Here is the slide: http://www.openbsd.org/papers/hackfest2015-pledge/mgp00011.html http://www.openbsd.org/papers/hackfest2015-pledge/mgp00011.h... And here is a link into the presentation video: https://youtu.be/F_7S1eqKsFk?t=13m2s https://youtu.be/F_7S1eqKsFk?t=13m2s