4 ms·
> Not only sandboxed, but many are pledge(2)'d now also. And here I was thinking that pledge(2) was the sandbox. Did I miss something?
by krylon 8y ago
> Not only sandboxed, but many are pledge(2)'d now also.
And here I was thinking that pledge(2) was the sandbox. Did I miss something?
- petee 8y agoIn a way, just not in the traditional filesystem sense; e.g., jail, chroot. Pledge allows a program to 'promise' which calls it is expected to make. For example, a program promising only to use 'stdio', will SIGABORT if you try to open a socket, fork, exec, or anything not part of the stdio group (as defined by pledge) https://man.openbsd.org/pledge.2 https://man.openbsd.org/pledge.2