3 ms·

Capabilities do this. It's the same mechanic used by containers to restrict their access. See man capabilities(7)

• drb91 8y ago
  Seems to be linux only at first blush.
  • akavel 8y ago
    I'm ok with focusing on Linux as the prime target for up. Though I'm totally trying to think about cross-platform approaches too, obviously.
    • codetrotter 8y ago
      FreeBSD has a capabilities system called “Capsicum”. https://www.freebsd.org/cgi/man.cgi?capsicum(4) https://www.freebsd.org/cgi/man.cgi?capsicum(4) https://wiki.freebsd.org/Capsicum https://wiki.freebsd.org/Capsicum https://www.cl.cam.ac.uk/research/security/capsicum/freebsd.html https://www.cl.cam.ac.uk/research/security/capsicum/freebsd.... Capsicum is convoluted though. OpenBSD has pledge and unveil, which from what I have seen are very elegant. https://man.openbsd.org/pledge.2 https://man.openbsd.org/pledge.2 https://man.openbsd.org/unveil https://man.openbsd.org/unveil
  • deleted 8y ago
    [deleted]