7 ms·

Capsicum

134 points by adamnemecek 8y ago

fulafel 8y ago
Aside: patch(1) from the example is a really good candidate for isolation. A few months ago we had this RCE: http://git.savannah.gnu.org/cgit/patch.git/commit/?id=123eaff0d5d1aebe128295959435b9ca5909c26d http://git.savannah.gnu.org/cgit/patch.git/commit/?id=123eaf...
raverbashing 8y ago
Apparently the author decided to not only replace all occurrences of "its" with it's, but all occurrences of "it" as well.
- loeg 8y ago
  The author is Polish and not a native English speaker, if that helps you understand the grammar.
2trill2spill 8y ago
It's too bad Capsicum was never merged into the Linux kernel[1]. It would have been nice to have one sandboxing API to use across the two operating systems, and the two projects could share the effort of sanboxing existing programs and libraries. [1]: http://www.capsicum-linux.org/ http://www.capsicum-linux.org/
- adamnemecek 8y ago
  Linux has its priorities somewhere else.
- amluto 8y ago
  All it needs is for someone to finish the port.
- brynet 8y ago
  Looks like that website hasn't been updated in years. I wonder why?
- Fnoord 8y ago
  Which are the current options for capability-based security on Linux?
notaplumber 8y ago
Capsicum is difficult to use, and has never been used to its full potential in FreeBSD. OpenBSD's pledge(2) and unveil(2) by comparison are seeing far greater usage, covering somewhere between 85% to 90% of the base operating system. Patches for 3rd party software, and programming languages are also appearing upstream, as they also serve as helpful annotation for other mechanisms and encourage privilege separation. https://man.openbsd.org/pledge https://man.openbsd.org/pledge https://man.openbsd.org/unveil https://man.openbsd.org/unveil https://gist.github.com/ligurio/f6114bd1df371047dd80ea9b8a55c104 https://gist.github.com/ligurio/f6114bd1df371047dd80ea9b8a55...
- trasz 8y ago
  The difference is that while Capsicum provides you with very solid, easy to reason about protection model. Meanwhile... can you still escape the pledge by reexecuting yourself?
  - notaplumber 8y ago
    > The difference is that while Capsicum provides you with very solid, ... ... That nothing uses. And even their flagship research example, Chrome, has never made it into the FreeBSD ports tree. OpenBSD has pledge(2)/unveil(2) for Chrome.
    - trasz 8y ago
      Not true - Capsicum is used by a growing amount of software, from base system utilities (like uefisign(8)) or servers (like ctld(8)) to third party stuff, like Irssi. And yes, there are language bindings as well. The problem with Chrome is not that it’s hard to capsicumize - it’s not, it has been done and documented - but rather that the upstream developers are extremely uncooperative wrt accepting patches.
      - notaplumber 8y ago
        Huh? FreeBSD has never included the Capsicum patches for chromium in ports. Google not accepting this upstream is a separate issue, albeit regretful, OpenBSD maintains the pledge/unveil patches and users benefit from this work today, whereas FreeBSD users cannot run Capsicum-ised Chrome. Capsicum patches are also considerably more intrusive, and their intention and protection is less clear.
trasz 8y ago
One other URL that might help understanding the "big picture" behind Capsicum is, and how it differs from most other sandboxing mechanisms, is this: https://en.wikipedia.org/wiki/Capability-based_security https://en.wikipedia.org/wiki/Capability-based_security. (It's not _that_ good, though; someone(tm) should eventually write an article explaining Capsicum from that point of view, since it's a pretty fundamental difference.)
rhizome 8y ago
I love this, it's like the unikernel of shell security.

134 points by adamnemecek 8y ago

Aside: patch(1) from the example is a really good candidate for isolation. A few months ago we had this RCE: http://git.savannah.gnu.org/cgit/patch.git/commit/?id=123eaff0d5d1aebe128295959435b9ca5909c26d http://git.savannah.gnu.org/cgit/patch.git/commit/?id=123eaf...

raverbashing 8y ago

Apparently the author decided to not only replace all occurrences of "its" with it's, but all occurrences of "it" as well.

loeg 8y ago
The author is Polish and not a native English speaker, if that helps you understand the grammar.

2trill2spill 8y ago

It's too bad Capsicum was never merged into the Linux kernel[1]. It would have been nice to have one sandboxing API to use across the two operating systems, and the two projects could share the effort of sanboxing existing programs and libraries. [1]: http://www.capsicum-linux.org/ http://www.capsicum-linux.org/

adamnemecek 8y ago
Linux has its priorities somewhere else.
amluto 8y ago
All it needs is for someone to finish the port.
brynet 8y ago
Looks like that website hasn't been updated in years. I wonder why?
Fnoord 8y ago
Which are the current options for capability-based security on Linux?

notaplumber 8y ago

Capsicum is difficult to use, and has never been used to its full potential in FreeBSD. OpenBSD's pledge(2) and unveil(2) by comparison are seeing far greater usage, covering somewhere between 85% to 90% of the base operating system. Patches for 3rd party software, and programming languages are also appearing upstream, as they also serve as helpful annotation for other mechanisms and encourage privilege separation. https://man.openbsd.org/pledge https://man.openbsd.org/pledge https://man.openbsd.org/unveil https://man.openbsd.org/unveil https://gist.github.com/ligurio/f6114bd1df371047dd80ea9b8a55c104 https://gist.github.com/ligurio/f6114bd1df371047dd80ea9b8a55...

trasz 8y ago
The difference is that while Capsicum provides you with very solid, easy to reason about protection model. Meanwhile... can you still escape the pledge by reexecuting yourself?
- notaplumber 8y ago
  > The difference is that while Capsicum provides you with very solid, ... ... That nothing uses. And even their flagship research example, Chrome, has never made it into the FreeBSD ports tree. OpenBSD has pledge(2)/unveil(2) for Chrome.
  - trasz 8y ago
    Not true - Capsicum is used by a growing amount of software, from base system utilities (like uefisign(8)) or servers (like ctld(8)) to third party stuff, like Irssi. And yes, there are language bindings as well. The problem with Chrome is not that it’s hard to capsicumize - it’s not, it has been done and documented - but rather that the upstream developers are extremely uncooperative wrt accepting patches.
    - notaplumber 8y ago
      Huh? FreeBSD has never included the Capsicum patches for chromium in ports. Google not accepting this upstream is a separate issue, albeit regretful, OpenBSD maintains the pledge/unveil patches and users benefit from this work today, whereas FreeBSD users cannot run Capsicum-ised Chrome. Capsicum patches are also considerably more intrusive, and their intention and protection is less clear.

trasz 8y ago

One other URL that might help understanding the "big picture" behind Capsicum is, and how it differs from most other sandboxing mechanisms, is this: https://en.wikipedia.org/wiki/Capability-based_security https://en.wikipedia.org/wiki/Capability-based_security. (It's not _that_ good, though; someone(tm) should eventually write an article explaining Capsicum from that point of view, since it's a pretty fundamental difference.)

rhizome 8y ago

I love this, it's like the unikernel of shell security.