4 ms·
Sounds similar to OpenBSD's `pledge`, a system call that a process can use to tell the system which minimum privileges it needs, so that a buffer overflow explo
by groovy2shoes 10y ago
Sounds similar to OpenBSD's `pledge`, a system call that a process can use to tell the system which minimum privileges it needs, so that a buffer overflow exploit has less of a chance of running amok (depending on the program). It's new in 5.9 and most of the base system and a bunch of ports (including Chromium) have been updated to make use of it.
Of course, it doesn't completely prevent someone from doing something nasty, but it does force them to be much more targeted in which programs they can attack. Every little thing helps a little bit, and it all adds up.
- cyphar 10y agoMy issue with pledge is that it doesn't get applied to the new process on exec. This makes it essentially useless for a program that needs to start any other programs to do it's job. Seccomp is quite cool because it lets you filter syscalls and then there's no way for you to disable the filtering (assuming no bugs in the implementation).
- IcePic 10y agoThen again, any program that in any way starts another binary (or several) would always end up having to pledge the sum of all possible child permissions, so it would just mean that any such program (like sudo) would just not be limited at all just so it can run both ls and reboot, when the setuid sudo program would be just the kind of program you would like to have pledged so that it doesn't talk net when it shouldn't or does other out of line weirdness.
- cyphar 10y agoRight, so then sudo could conditionally pledge things based on what its ACL says. And that whitelist would apply to the program it starts. I'd understand there being "temporary" pledges, where it gets reset on exec, but I don't understand making it by default temporary.