3 ms·
> setting it up to be conservative just like OpenBSD Meh. Probably for superficial stuff, yes. But would Linux kill cat(1) if it did some network calls? I bet
by moviuro 7y ago
> setting it up to be conservative just like OpenBSD
Meh. Probably for superficial stuff, yes. But would Linux kill cat(1) if it did some network calls? I bet not. See https://www.openbsd.org/innovations.html https://www.openbsd.org/innovations.html
- roryrjb 7y agoYou can do this with seccomp, but of course not by default like pledge and OpenBSD.
- ailideex 7y agoYou could block it's network access with network namespaces: http://man7.org/linux/man-pages/man1/unshare.1.html http://man7.org/linux/man-pages/man1/unshare.1.html I'm sure you could engineering something to kill it also with currently kernel functionality - though I would need to do more research to say what.
- majewsky 7y agoBPF can filter syscalls.
- pas 7y agoAppArmor does that. I don't know what's the default profile for cat, but a simple one line "deny network;" works. It's up to the distribution.