3 ms·
Out of curiosity, what would be the point of restricting child processes to specific directories? If I trust a binary to read a directory, what's the point of
by the_duke 8y ago
Out of curiosity, what would be the point of restricting child processes to specific directories?
If I trust a binary to read a directory, what's the point of constraining specific processes further?
The only use case I could think of is where the binary itself runs untrusted code from a third party. (e.g. plugins).
- Someone 8y agounveil also protects you against untrusted code you wrote yourself (and yes, you shouldn’t trust code you wrote yourself. You may know it doesn’t do anything wrong on purpose, but it might be buggy and do something wrong by accident) Also, if you didn’t write the OS, your untrusted code will call third party code, if it is worth running it at all (it has to communicate results back to the caller. That requires some OS calls, even if only to trigger some semaphore)
- mikeash 8y agoIf you ever read untrusted data, you should consider the possibility that you’ll be exploited and end up running untrusted code even though you never intended to.
- masklinn 8y agoThe point of pledge(2) (and unveil which builds on and complements pledge(2)) is to protect against the consequences of human failing: if the software has an accessible exploit, limiting its ability to see the system means the attacker has a much harder time pivoting into something useful. That's why pledge(2) and unveil(2) are useful despite literally being part of the software it restricts.