4 ms·

https://man.openbsd.org/pledge.2 https://man.openbsd.org/pledge.2 is also pretty damn cool. It effectively lets you make your program use a least authority mode

https://man.openbsd.org/pledge.2 https://man.openbsd.org/pledge.2 is also pretty damn cool. It effectively lets you make your program use a least authority model of execution, and then you can grant it the capabilities it actually needs to run. I would love to see something similar on Linux (there is capsicum-linux, but it seems like it's abandoned).

rurban 7y ago
Totally uncool and a dead end. Nobody else will do it that way. "The promises argument is specified as a string, with space separated keywords". caps as strings to be tokenized at runtime are slow, insecure and not validated at compile-time. Never trust a parser in core. This needs to be a bitmask of course. Don't let ruby programmers add OS API's.
- gpvos 7y ago
  The intended ad hominem in the last sentence does very much not apply.
  - unixhero 7y ago
    Nah no ad hominem taken! I thought it was funny. I write Ruby, and love it, and wouldn't go near OS API design with a tenth foot pole.
    - jabot 7y ago
      That's about 3cm. Pretty close ;-)
      - gpvos 7y ago
        I wouldn't touch it, but watching it up close is quite interesting.
- ksec 7y ago
  What has it got to do with Ruby ?
  - rurban 7y ago
    Just an example. Could be perl also, but ruby was the fashion then.
- enriquto 7y ago
  > Never trust a parser in core. So, we have to part ways with our dear printk ?
  - rurban 7y ago
    That would be fantastic, sure. It's a security nightmare. Know about the printf_s extensions? Maintainability?
roryrjb 7y ago
So like seccomp? Or do you mean a simpler interface like pledge? I haven't really used the seccomp syscall or eBPF directly but I have used libseccomp (https://github.com/seccomp/libseccomp https://github.com/seccomp/libseccomp) successfully.
- anaphor 7y ago
  seccomp and eBPF will let you build something like this but it does not do the same thing as pledge.
  - roryrjb 7y ago
    I'm not saying you're wrong, but at least in terms of the default behaviour of pledge with regard syscalls and configuring seccomp so the kernel kills your whole process when it hits a syscall you haven't whitelisted, it sounds the same, so it would be good to know what the differences are.
    - anaphor 7y ago
      I think the difference is just that seccomp/eBPF is lower level and more powerful in terms of what it can do. So pledge gives you a simpler interface to manage things, whereas with eBPF you have much more flexibility (since you're writing in a subset of C) but with that flexibility also comes more complexity. I.e., eBPF is its own scripting language for the kernel, pledge is just a way of managing fine-grained capabilities.

rurban 7y ago

Totally uncool and a dead end. Nobody else will do it that way. "The promises argument is specified as a string, with space separated keywords". caps as strings to be tokenized at runtime are slow, insecure and not validated at compile-time. Never trust a parser in core. This needs to be a bitmask of course. Don't let ruby programmers add OS API's.

gpvos 7y ago
The intended ad hominem in the last sentence does very much not apply.
- unixhero 7y ago
  Nah no ad hominem taken! I thought it was funny. I write Ruby, and love it, and wouldn't go near OS API design with a tenth foot pole.
  - jabot 7y ago
    That's about 3cm. Pretty close ;-)
    - gpvos 7y ago
      I wouldn't touch it, but watching it up close is quite interesting.
ksec 7y ago
What has it got to do with Ruby ?
- rurban 7y ago
  Just an example. Could be perl also, but ruby was the fashion then.
enriquto 7y ago
> Never trust a parser in core. So, we have to part ways with our dear printk ?
- rurban 7y ago
  That would be fantastic, sure. It's a security nightmare. Know about the printf_s extensions? Maintainability?

roryrjb 7y ago

So like seccomp? Or do you mean a simpler interface like pledge? I haven't really used the seccomp syscall or eBPF directly but I have used libseccomp (https://github.com/seccomp/libseccomp https://github.com/seccomp/libseccomp) successfully.

anaphor 7y ago
seccomp and eBPF will let you build something like this but it does not do the same thing as pledge.
- roryrjb 7y ago
  I'm not saying you're wrong, but at least in terms of the default behaviour of pledge with regard syscalls and configuring seccomp so the kernel kills your whole process when it hits a syscall you haven't whitelisted, it sounds the same, so it would be good to know what the differences are.
  - anaphor 7y ago
    I think the difference is just that seccomp/eBPF is lower level and more powerful in terms of what it can do. So pledge gives you a simpler interface to manage things, whereas with eBPF you have much more flexibility (since you're writing in a subset of C) but with that flexibility also comes more complexity. I.e., eBPF is its own scripting language for the kernel, pledge is just a way of managing fine-grained capabilities.