2 ms·
Because you can get the same technical outcome with using off the shelf Linux and setting it up to be conservative just like OpenBSD. (Or simply run sensitive w
by pas 7y ago
Because you can get the same technical outcome with using off the shelf Linux and setting it up to be conservative just like OpenBSD. (Or simply run sensitive workloads on separated/isolated machines.) The dreaded TCO is likely lower with Linux, because it's easier to work with, better drivers, better performance, more software available natively, and so on. (The whole Linux ecosystem seems more efficient for business, even if OpenBSD/FreeBSD is simply better in a lot of particular stuff.)
- moviuro 7y ago> setting it up to be conservative just like OpenBSD Meh. Probably for superficial stuff, yes. But would Linux kill cat(1) if it did some network calls? I bet not. See https://www.openbsd.org/innovations.html https://www.openbsd.org/innovations.html
- roryrjb 7y agoYou can do this with seccomp, but of course not by default like pledge and OpenBSD.
- ailideex 7y agoYou could block it's network access with network namespaces: http://man7.org/linux/man-pages/man1/unshare.1.html http://man7.org/linux/man-pages/man1/unshare.1.html I'm sure you could engineering something to kill it also with currently kernel functionality - though I would need to do more research to say what.
- majewsky 7y agoBPF can filter syscalls.
- pas 7y agoAppArmor does that. I don't know what's the default profile for cat, but a simple one line "deny network;" works. It's up to the distribution.