3 ms·
I believe the usecase is similar to BSD's pledge. See https://man.openbsd.org/pledge.2 https://man.openbsd.org/pledge.2 It allows you to drop privileges so tha
by boustrophedon 5y ago
I believe the usecase is similar to BSD's pledge. See https://man.openbsd.org/pledge.2 https://man.openbsd.org/pledge.2
It allows you to drop privileges so that in the event there is a vulnerability in your application, it cannot be exploited to cause further damage outside the scope of the application's normal operations.
- wahern 5y agoNot pledge, but unveil: https://man.openbsd.org/unveil.2 https://man.openbsd.org/unveil.2 AFAICT, landlock even uses the same underlying technique in the VFS layer.