3 ms·
pledge is objectively the wrong model, because it's an ad-hoc set of fixed-function rules. By contrast, Linux seccomp-bpf allows much more flexibility, because
by pcwalton 8y ago
pledge is objectively the wrong model, because it's an ad-hoc set of fixed-function rules. By contrast, Linux seccomp-bpf allows much more flexibility, because you can actually write an arbitrary program to implement whatever sandboxing policy you want.
In fact, your wish list highlights the problems of pledge precisely. You can implement "pretend to succeed" and "dump core for inspection by a trusted supervisor", but only on Linux with seccomp-bpf, not with pledge.
- ori_b 8y agoIt's objectively the right model, because it's simple enough to implement that the vast majority of OpenBSD is pledged, including many ports like Firefox. The vast majority of other systems do not have the equivalent, in spite of having mechanisms that are in theory more powerful than pledge. Flexible sandboxes don't help if your programs don't run in them.
- kbenson 8y agoMaybe it's objectively the right model for right now, and the wrong model for tomorrow, which would make you both right. It's hard to get programmers and packagers to add new OS specific features, at least until most OS's support from variant of that feature, and then they either bite the bullet or they use from library to abstract it. Pledge is simple, and that helps people adopt it and start using it. When most operating systems are providing something equivalent and most programs are making some use of it, it then becomes a selling point to do it better, because the status quo has moved. At that point, pledge might not compare well, unless it has evolved.
- ori_b 8y ago> Maybe it's objectively the right model for right now, and the wrong model for tomorrow. I'm using my computer right now. And pledge is evolving over time, as we gain experience in what real programs need by implementing protection for them.
- kbenson 8y agoSure, but some things are hard to evolve after a while, and it may be that a clean (or older but more complex) implementation has advantages at some point. I have no idea if pledge will fall under this or not, but it's a common theme in computing.
- deleted 8y ago[deleted]
- pcwalton 8y agoFirefox is sandboxed via seccomp-bpf on Linux.
- jakeogh 8y agoAwesome. I just checked, and it appears one FF process is, and one is not: https://bpaste.net/show/d8b3d6ada513 https://bpaste.net/show/d8b3d6ada513 https://wiki.mozilla.org/Security/Sandbox/Seccomp https://wiki.mozilla.org/Security/Sandbox/Seccomp I would like much more general control, like disable write, or prevent forks, or net access, right from the executing shell. I have selinux experience, and it's too low level.
- adrianN 8y agoI think the idea behind pledge was that it's simple enough to be actually used whereas the Linux solution is technically superior but too complicated to be widely used.
- jakeogh 8y agoI was not referring to the implementation. The first , should be a ;. I agree, bpf looks sweet. It might be so useful that it becomes optional only in spirit.
- foodstances 8y agoHow many programs are running on your computer right now with seccomp-bpf policies?