5 ms·

The PDF has no introduction section, seems to be aimed at people who already know what it's talking about. Can anyone shed some light on what is the idea here?

• beefhash 8y ago
  pledge(2) on OpenBSD is used to drop the privileges of a process. Processes are meant to call pledge(2) to drop their own privileges. The way pledge(2) works is that the system calls of that process get limited. If a process calls a system call outside the allowed range after calling pledge(2), it gets killed. Starting with OpenBSD 6.3, it is also possible to configure pledge to make the kernel return ENOSYS instead of killing the process when violating the pledge. For example: /* Only the system calls required * for the standard I/O library and * for accessing /dev/tty are allowed * by the kernel from this point on. */ pledge("stdio tty", NULL); The second argument is the execpromises, i.e., the pledges enforced for child processes. This does not need to be specified if you pledge in a way that does not include any way of spawning a new process. What's new in the slides linked is unveil(2). This seems to be used to limit the exact paths a process can access and with what access flags (rwxc).
  • Fnoord 8y ago
    Wasn't there some kind of equiv in OpenBSD long ago, by Niels Provos? Or was it the Stephanie patch? [1] At the bottom they mention Qmail which was immediately my first thought as an example as well, since it breaks up MTA tasks to different daemons. [1] http://packetfactory.openwall.net/projects/stephanie/index.html http://packetfactory.openwall.net/projects/stephanie/index.h...
    • nbe 8y ago
      I think you're refering to systrace. It was removed in OpenBSD 6.0. http://www.citi.umich.edu/u/provos/systrace/ http://www.citi.umich.edu/u/provos/systrace/
      • Fnoord 8y ago
        Thanks, that's exactly what I meant. Why was it removed? I did notice pledge(2) first appeared in 5.9 [1] How do other Unices such as Linux deal with this issue (IIRC systrace was ported to other Unices)? Is Pledge ported to other BSDs? [1] http://man.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man2/pledge.2 http://man.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man2/...
        • 4ad 8y ago
          Systrace was removed because it's unsafe for multi-threaded programs because of TOCTOU.
          • gpvos 8y ago
            TOCTOU = time-of-check time-of-use
          • wahern 8y ago
            The race only existed for path strings. systrace was no worse than seccomp in this respect (which doesn't even permit filtering on paths precisely because of the systrace exploit), yet still much easier to use. systrace was removed because it went largely unused. Theoretically powerful, in practice it made the wrong compromises. seccomp recapitulated the same compromises, and it's not surprising seccomp uptake has been similarly weak.
        • nbe 8y ago
          From what I understand it was not maintained anymore, and it was also hard to keep up to date lists of allowed or forbidden system calls for the binaries that had to be run under systrace. [1] [2] Linux provide seccomp-bpf for system call restrictions. [3] [1] https://marc.info/?l=openbsd-misc&m=146170224108205&w=2 https://marc.info/?l=openbsd-misc&m=146170224108205&w=2 [2] http://www.openbsd.org/papers/hackfest2015-pledge/mgp00009.html http://www.openbsd.org/papers/hackfest2015-pledge/mgp00009.h... [3] https://lwn.net/Articles/656307/ https://lwn.net/Articles/656307/
        • 2trill2spill 8y ago
• sigjuice 8y ago
  pledge is seccomp
  • lkurusa 8y ago
    Not really; seccomp(2) is for _specific_ system calls, pledge(2) is for more broad functionalities.
    • deleted 8y ago
      [deleted]
    • sigjuice 8y ago
      I didn’t say they are bug-for-bug compatible and 100% interchangeable. Seccomp was not mentioned anywhere in the thread. People who are interested can look up the specific details.
  • brynet 8y ago
    Not at all, for example you can't implement the ratcheting down semantics of pledge() using seccomp. Say starting with a broader promise set "stdio rpath recvfd", and then dropping to "stdio" after full init. pledge() can also be found in over 85% of OpenBSD's base system.
    • kworker 8y ago
      On linux you can use firejail if it's necessary (or a container if it's needed).
      • staticassertion 8y ago
        This doesn't address what they just said - dropping privileges incrementally. Firejail is just a whole process filter applied at process start.
    • agumonkey 8y ago
      brings me to the next question: are there linux equivalent ?