3 ms·

OpenBSD was already using pledge(2) to protect the different chrome process types, many of them can't access the filesystem directly. Chrome actually has a priv

by brynet 8y ago

OpenBSD was already using pledge(2) to protect the different chrome process types, many of them can't access the filesystem directly. Chrome actually has a privsep design, IPC, fd passing over Unix sockets etc. For example, the GPU and plugin processes can only act on file descriptors received this way: https://github.com/openbsd/ports/blob/master/www/chromium/patches/patch-services_service_manager_sandbox_openbsd_sandbox_openbsd_cc#L227 https://github.com/openbsd/ports/blob/master/www/chromium/pa... But this alone doesn't protect this "bridge" process itself from accessing the filesystem, this includes your SSH keys, which is where unveil() comes in.

masklinn 8y ago
> But this alone doesn't protect this "bridge" process itself from accessing the the filesystem Of course not, but the point is that the bridge process only comes in contact with the user and a software invoking it, and its sole purpose is to pick a file on the filesystem. Including your ssh pubkey if that's what you need to select/upload.
- brynet 8y ago
  Perhaps that's the case, and that's all it's doing, but at least for chromium, it's the main browser process itself currently handling the Open/Save File dialog box.