5 ms·

I wonder if the OS world will move towards lightweight but unforgiving sandboxing like OpenBSD's `pledge` and `unveil` system calls. It's crazy to me that most

I wonder if the OS world will move towards lightweight but unforgiving sandboxing like OpenBSD's `pledge` and `unveil` system calls. It's crazy to me that most software is still completely fine to run around and set things as fire the instant it's compromised! This is about the implementation in the SerenityOS but it's my favourite explanation so far: https://awesomekling.github.io/pledge-and-unveil-in-SerenityOS/ https://awesomekling.github.io/pledge-and-unveil-in-Serenity...

saddlerustle 6y ago
iOS, Android and ChromeOS are already there. But for exploits targeting Exchange or Teams it's far from a perfect solution because valuable private information is in the app being compromised.
brundolf 6y ago
Most desktop OSes came about (or at least have their roots in) a pre-internet world, where you install software from discs you purchased at the store, or if you're feeling gutsy, from media your friend hands you in real-life. They assume you have a great amount of trust in every piece of code you run on your computer (and anyway, how will malware exfiltrate your data without an always-on network connection?). Things like Windows Defender and Snap and the recent macOS hardening efforts are patchwork solutions to try and cope with the modern world, but they'll never really be enough because these systems can't be fundamentally re-thought; they have to keep doing everything everybody already expects them to do. Only brand new OSes really get the chance to do things right, and only the mobile ones really had the opportunity to gain wide adoption.
TwoBit 6y ago
I don't see how the large majority of security problems could be solved by any OS design. Human failures would just account for 95% of breaches instead of the current 85% (made up numbers). Not saying the OS improvements aren't useful nevertheless..
- HappyTypist 6y ago
  Good design can dramatically reduce, if not eliminate, most human vulnerabilities. For example, phishing sites would be radically less effective if passwords are not a thing, and everyone logged in using hardware keys (e.g. Yubikeys) which cryptographically prevent phishing.
- xvector 6y ago
  See Qubes. Your compromised app can’t do much without a Xen hypervisor zero-day.
  - tatersolid 6y ago
    > Your compromised app can’t do much without a Xen hypervisor zero-day. Of which there have been plenty.
    - xvector 6y ago
      Attack surface is much lower. Qubes is a massive improvement over a monolithic OS.
nightpool 6y ago
Just last week we were talking about a zero-click bug in Apple Mail (https://mikko-kenttala.medium.com/zero-click-vulnerability-in-apples-macos-mail-59e0c14b106c https://mikko-kenttala.medium.com/zero-click-vulnerability-i...) that didn't even need to bypass Apple's built-in sandboxing—simply overwriting Mail.app's config files was enough to trigger a devastating information disclosure.
d110af5ccf 6y ago
Doesn't the equivalent already exist in Linux? BPF seccomp filters have been around since ~2012 (https://lwn.net/Articles/656307 https://lwn.net/Articles/656307). There's also SELinux and friends (ie Linux Security Modules).
- Rendello 6y ago
  Pledge was created as a response to low `seccomp` (Linux) and `capsicum` (FreeBSD) usage in the wild. Pledge trades off granularity for ease-of-use, and has seen quite a bit of adoption despite OpenBSD being a small ecosystem. As a Linux-based programmer who hasn't quite delved into the UNIX internals world, knowing that I have to write my own BPF filter or do some crazy stuff with file descriptors (in the case of capsicum) is enough to scare me. But on OpenBSD, I added `pledge` and `unveil` calls to all my silly Python chat bots in 15 mintes
  - d110af5ccf 6y ago
    Yeah the idea of wrangling raw BPF is a bit daunting. Just FYI, libseccomp (https://github.com/seccomp/libseccomp https://github.com/seccomp/libseccomp) exists to abstract away all the BPF stuff. It even comes prepackaged by the major distros (ex https://packages.debian.org/sid/libseccomp2 https://packages.debian.org/sid/libseccomp2) so you don't even have to compile it yourself.

saddlerustle 6y ago

iOS, Android and ChromeOS are already there. But for exploits targeting Exchange or Teams it's far from a perfect solution because valuable private information is in the app being compromised.

brundolf 6y ago

Most desktop OSes came about (or at least have their roots in) a pre-internet world, where you install software from discs you purchased at the store, or if you're feeling gutsy, from media your friend hands you in real-life. They assume you have a great amount of trust in every piece of code you run on your computer (and anyway, how will malware exfiltrate your data without an always-on network connection?). Things like Windows Defender and Snap and the recent macOS hardening efforts are patchwork solutions to try and cope with the modern world, but they'll never really be enough because these systems can't be fundamentally re-thought; they have to keep doing everything everybody already expects them to do. Only brand new OSes really get the chance to do things right, and only the mobile ones really had the opportunity to gain wide adoption.

TwoBit 6y ago

I don't see how the large majority of security problems could be solved by any OS design. Human failures would just account for 95% of breaches instead of the current 85% (made up numbers). Not saying the OS improvements aren't useful nevertheless..

HappyTypist 6y ago
Good design can dramatically reduce, if not eliminate, most human vulnerabilities. For example, phishing sites would be radically less effective if passwords are not a thing, and everyone logged in using hardware keys (e.g. Yubikeys) which cryptographically prevent phishing.
xvector 6y ago
See Qubes. Your compromised app can’t do much without a Xen hypervisor zero-day.
- tatersolid 6y ago
  > Your compromised app can’t do much without a Xen hypervisor zero-day. Of which there have been plenty.
  - xvector 6y ago
    Attack surface is much lower. Qubes is a massive improvement over a monolithic OS.

nightpool 6y ago

Just last week we were talking about a zero-click bug in Apple Mail (https://mikko-kenttala.medium.com/zero-click-vulnerability-in-apples-macos-mail-59e0c14b106c https://mikko-kenttala.medium.com/zero-click-vulnerability-i...) that didn't even need to bypass Apple's built-in sandboxing—simply overwriting Mail.app's config files was enough to trigger a devastating information disclosure.

d110af5ccf 6y ago

Doesn't the equivalent already exist in Linux? BPF seccomp filters have been around since ~2012 (https://lwn.net/Articles/656307 https://lwn.net/Articles/656307). There's also SELinux and friends (ie Linux Security Modules).

Rendello 6y ago
Pledge was created as a response to low `seccomp` (Linux) and `capsicum` (FreeBSD) usage in the wild. Pledge trades off granularity for ease-of-use, and has seen quite a bit of adoption despite OpenBSD being a small ecosystem. As a Linux-based programmer who hasn't quite delved into the UNIX internals world, knowing that I have to write my own BPF filter or do some crazy stuff with file descriptors (in the case of capsicum) is enough to scare me. But on OpenBSD, I added `pledge` and `unveil` calls to all my silly Python chat bots in 15 mintes
- d110af5ccf 6y ago
  Yeah the idea of wrangling raw BPF is a bit daunting. Just FYI, libseccomp (https://github.com/seccomp/libseccomp https://github.com/seccomp/libseccomp) exists to abstract away all the BPF stuff. It even comes prepackaged by the major distros (ex https://packages.debian.org/sid/libseccomp2 https://packages.debian.org/sid/libseccomp2) so you don't even have to compile it yourself.