4 ms·
My issue with pledge is that it doesn't get applied to the new process on exec. This makes it essentially useless for a program that needs to start any other pr
by cyphar 11y ago
My issue with pledge is that it doesn't get applied to the new process on exec. This makes it essentially useless for a program that needs to start any other programs to do it's job.
Seccomp is quite cool because it lets you filter syscalls and then there's no way for you to disable the filtering (assuming no bugs in the implementation).
- IcePic 11y agoThen again, any program that in any way starts another binary (or several) would always end up having to pledge the sum of all possible child permissions, so it would just mean that any such program (like sudo) would just not be limited at all just so it can run both ls and reboot, when the setuid sudo program would be just the kind of program you would like to have pledged so that it doesn't talk net when it shouldn't or does other out of line weirdness.
- cyphar 11y agoRight, so then sudo could conditionally pledge things based on what its ACL says. And that whitelist would apply to the program it starts. I'd understand there being "temporary" pledges, where it gets reset on exec, but I don't understand making it by default temporary.