6 ms·
Not at all, for example you can't implement the ratcheting down semantics of pledge() using seccomp. Say starting with a broader promise set "stdio rpath recvfd
by brynet 8y ago
Not at all, for example you can't implement the ratcheting down semantics of pledge() using seccomp. Say starting with a broader promise set "stdio rpath recvfd", and then dropping to "stdio" after full init.
pledge() can also be found in over 85% of OpenBSD's base system.
- kworker 8y agoOn linux you can use firejail if it's necessary (or a container if it's needed).
- staticassertion 8y agoThis doesn't address what they just said - dropping privileges incrementally. Firejail is just a whole process filter applied at process start.
- agumonkey 8y agobrings me to the next question: are there linux equivalent ?
- 2trill2spill 8y agoThere's Capsicum for Linux[1]. Its a port of Capsicum[2] from FreeBSD to Linux. Capsicum was a joint project between the FreeBSD foundation, Cambridge and Google to create a hybrid capabilities framework. But Capsicum allows developers to do the same privilege dropping that pledge does. However Capsicum is more fine grained then pledge so its less easy to use. Also Capsicum for Linux is also out of tree currently. [1]: http://www.capsicum-linux.org/ http://www.capsicum-linux.org/ [2]: https://www.freebsd.org/cgi/man.cgi?capsicum(4) https://www.freebsd.org/cgi/man.cgi?capsicum(4)
- jpeeler 8y agoLink #1 is neat for Linux users, but Google seems to have stopped updating Capsicum after v4.11 (which was released April 2017).
- kworker 8y agoThe firejail is the closest i know.