4 ms·
But conveniently the at() stuff has allowed for capabilities-based security with Capsicum, CloudABI (RIP) and now WASI. Since the at() functions exist, these e
by floatboth 5y ago
But conveniently the at() stuff has allowed for capabilities-based security with Capsicum, CloudABI (RIP) and now WASI.
Since the at() functions exist, these environments can just not have a global filesystem namespace – there is no open(), only openat() under the descriptors you have. No escaping up from the sandbox!
- singron 5y agoCan't you openat(fd,"..")? I don't think this is a sufficient sandbox.
- floatboth 5y agoNo, not in a capability-based environment. Once you cap_enter() on FreeBSD, you can't – that's the whole point. Same in proper WASI runtime implementations. Please don't assume people are stupid ;) These sandboxes have been carefully designed and extensively tested.
- justincormack 5y agoopenat2 now has RESOLVE_BENEATH to fix that.