3 ms·
Doesn't the equivalent already exist in Linux? BPF seccomp filters have been around since ~2012 (https://lwn.net/Articles/656307 https://lwn.net/Articles/656307
by d110af5ccf 6y ago
Doesn't the equivalent already exist in Linux? BPF seccomp filters have been around since ~2012 (https://lwn.net/Articles/656307 https://lwn.net/Articles/656307). There's also SELinux and friends (ie Linux Security Modules).
- Rendello 6y agoPledge was created as a response to low `seccomp` (Linux) and `capsicum` (FreeBSD) usage in the wild. Pledge trades off granularity for ease-of-use, and has seen quite a bit of adoption despite OpenBSD being a small ecosystem. As a Linux-based programmer who hasn't quite delved into the UNIX internals world, knowing that I have to write my own BPF filter or do some crazy stuff with file descriptors (in the case of capsicum) is enough to scare me. But on OpenBSD, I added `pledge` and `unveil` calls to all my silly Python chat bots in 15 mintes
- d110af5ccf 6y agoYeah the idea of wrangling raw BPF is a bit daunting. Just FYI, libseccomp (https://github.com/seccomp/libseccomp https://github.com/seccomp/libseccomp) exists to abstract away all the BPF stuff. It even comes prepackaged by the major distros (ex https://packages.debian.org/sid/libseccomp2 https://packages.debian.org/sid/libseccomp2) so you don't even have to compile it yourself.