6 ms·
Here's Theo de Raadt explaining how pledge(2) works: https://www.youtube.com/watch?v=F_7S1eqKsFk https://www.youtube.com/watch?v=F_7S1eqKsFk
by teamhappy 11y ago
Here's Theo de Raadt explaining how pledge(2) works: https://www.youtube.com/watch?v=F_7S1eqKsFk https://www.youtube.com/watch?v=F_7S1eqKsFk
- kristopolous 11y agocan anyone provide a textual description of what this is? so far all I've found is a broken manpage and a slideshow presentation without much explanation.
- tobik 11y agohttp://man.openbsd.org/OpenBSD-current/man2/pledge.2 http://man.openbsd.org/OpenBSD-current/man2/pledge.2 and the slides to the presentation http://www.openbsd.org/papers/hackfest2015-pledge/index.html http://www.openbsd.org/papers/hackfest2015-pledge/index.html
- kristopolous 11y agothanks ... that works. Also this register article is decent: http://www.theregister.co.uk/2015/11/10/untamed_pledge_hopes_to_improve_openbsd_security/ http://www.theregister.co.uk/2015/11/10/untamed_pledge_hopes...
- plank 11y agoThank you for the links. Reading the presentation, and ignoring the 'monkey' and 'loudmouth' comments, made me think this could be seen as an implementation of the 'intent security' capability that Android has through its Manifests. Although I assume (I did not go through all the slides) that implementing this is 'slightly' more complex due to the number of things you can pledge to use/non-use.
- deleted 11y ago[deleted]
- rubiquity 11y agopledge allows a process to declares privileges it needs to function. If the process accesses something beyond those pledges then the Kernel kills the process. The idea is that this will help reduce the surface area that certain types of attacks like remote code execution can have.
- vidoc 11y agoThanks for the link! Mr DeRaadt should clearly think about starting a therapy.
- deleted 11y ago[deleted]
- shirro 11y agoThis seems like such an elegant idea it is surprising that it hasn't been done before. I can imagine adding pledge calls to software I write myself. I can't say that for most other policy systems.
- deleted 11y ago[deleted]
- xorcist 11y agoHasn't it? It doesn't look very different from the many syscall filters out there, of which the seccomp family is most used. That's what Chrome and OpenSSH uses to sandbox. Perhaps the design of pledge will turn out to have advantages, but it's a pity the unix world fragments yet again on something that should be trivial. Either people will limit themselves to chroot as the only portable solution, or hairy libraries will be necessary (like libevent .. no, libev.. wait, libuv).
- teamhappy 11y ago> [...] but it's a pity the unix world fragments yet again > on something that should be trivial. FWIW: Theo mentions in the talk that he's willing to change things if that makes it easier for other operating systems to adopt pledge(2).
- shirro 11y agoThe simplicity of the interface is what feels novel to me. It probably isn't an issue with a project like Chrome or Firefox to find someone able to understand all the intricacies of seccomp-bpf and implement it properly. And I am sure seccomp is a much more powerful solution. But for a sole programmer or small team writing some micro-services or similar it seems unlikely they are going to bother. By comparison sending a string with some well chosen categories looks so ridiculously easy it lowers the barriers a lot.
- BogusIKnow 11y agoContent starts at around 14:30 minutes if you want to jump over the bashing of others and self-adulation by Theo.
- _asummers 11y agoBut you miss the wonderfully absurd gif at the ~02:00 mark.