3 ms·
Seccomp is painful, you need to fork a 'seccomp' fork as you cannot seccomp the parent and child to differing permissions, With pledge this is simple.
by nwmcsween 6y ago
Seccomp is painful, you need to fork a 'seccomp' fork as you cannot seccomp the parent and child to differing permissions, With pledge this is simple.
- viraptor 6y agoForking then setting a policy in parent works though (if you don't need to spawn more workers). Or you can have a "worker spawner" process.
- nwmcsween 6y agoAnd that defeats a large portion of how programs work by first having root to bind to low ports, etc then forking a worker not to mention you have to restructure your program for seccomp vs ifdef for pledge. There are a bunch of ways of sandboxing on Linux but not many projects use it because implementing it is just painful, compared to pledge even external projects outside of openbsd will accept simple ifdef patches to support easy sandboxing.
- viraptor 6y agoFortunately socket activation is gaining support. The whole idea of having a privileged process just to bind can be skipped. But even without it, I'm not sure why it matters for seccomp - you bind then you apply the policy. Just like typically you first bind, then setuid.