3 ms·
they only exist on OpenBSD. They're used a lot for default OpenBSD binaries, but they are mostly hopeless for openbsd developers/porters to try to apply to port
by dbt00 5y ago
they only exist on OpenBSD. They're used a lot for default OpenBSD binaries, but they are mostly hopeless for openbsd developers/porters to try to apply to portable software after the fact if the upstream devs aren't supporting that work.
(There are other mechanisms like containers or freebsd' jail that try to accomplish the same thing, but those tend to be "lots of functionality inside the sandbox" solutions, whereas openbsd is mostly aiming for "allow nothing besides the minimum in the sandbox".
(edited for clarity, thanks for the nudge ghoward).
- ghoward 5y agoI upvoted, but I wanted to correct a small thing. > ...they are mostly hopeless to try to apply to portable software after the fact if the devs aren't constantly testing with it. They don't have to be hopeless. They were pretty easy ([1], [2]) to add to my bc. [1]: https://git.yzena.com/gavin/bc/commit/3e8cd345de9d5b65ac7c339b98a67b9fc3d87d9f https://git.yzena.com/gavin/bc/commit/3e8cd345de9d5b65ac7c33... [2]: https://git.yzena.com/gavin/bc/commit/b6c65bb44c910c054bedfaab40a4b9283345e080 https://git.yzena.com/gavin/bc/commit/b6c65bb44c910c054bedfa...
- dbt00 5y agoYes. That's awesome! I was referring to the OpenBSD devs trying to hack pledges into other people's software by trying to guess what capabilities it needs while porting. That's not a good thing to try to do -- see also all the various attempts at guessing seccomp profiles in the Linux world, which has the same problem.