4 ms·
Between templated unit files and systemd-run things can be a bit more dynamic, but yeah, not at runtime. As I understand it, seccomp can do what unveil and ple
by justinsaccount 8y ago
Between templated unit files and systemd-run things can be a bit more dynamic, but yeah, not at runtime.
As I understand it, seccomp can do what unveil and pledge can do, just with a much more complicated API. I wonder if anyone is working on a pledge/unveil compatible wrapper API for seccomp...
- brynet 8y agoNot at all, for example you can't implement the ratchet down semantics of pledge() using seccomp. For instance having initial broader promise set "stdio rpath recvfd", and then irrevocably dropping to a runtime promise of "stdio" after init. This is a very paradigmatic use of pledge(2), which a large portion of the 85% of OpenBSD's base system pledged will demonstrate. unveil(2) would be very challenging, if not impossible. Both would require proper Linux integration and kernel implementation.
- deleted 8y ago[deleted]
- brynet 8y agoPeople have certainly attempted to cobble something together using different pieces on Linux, but the semantics will never be truly perfect unless a native implementation is attempted.