4 ms·
Important pieces of the puzzle are Kristaps' kcgi (perhaps kwebapp/ksql). https://kristaps.bsd.lv/kcgi/ https://kristaps.bsd.lv/kcgi/ And also OpenBSD pledge
by notaplumber 8y ago
Important pieces of the puzzle are Kristaps' kcgi (perhaps kwebapp/ksql).
https://kristaps.bsd.lv/kcgi/ https://kristaps.bsd.lv/kcgi/
And also OpenBSD pledge / "sandboxing" on other OSs
https://man.openbsd.org/pledge https://man.openbsd.org/pledge
https://learnbchs.org/pledge.html https://learnbchs.org/pledge.html
https://kristaps.bsd.lv/kcgi/tutorial6.html https://kristaps.bsd.lv/kcgi/tutorial6.html
- krylon 8y agoI really hope other systems will adopt pledge. Of all the selective privilege dropping mechanisms I know of, pledge seems to be the least complicated to use.
- pjmlp 8y agoMojave has a new security aware runtime for its applications. Bringing sandboxing to all applications and requiring listing of entitlements and digital signing. Microsoft has decided if the apps don't come to the store, the store goes to the apps, and are merging Win32 with UWP sandboxing concepts via Windows containers and the new MSIX package format. Android sandboxing is still the most complicated one.