3 ms·

it's so great and nobody porting this to the other BSDs?

• mzs 4y ago
  FreeBSD already has capsicum which unfortunately is more complicated than pledge/unveil: https://wiki.freebsd.org/Capsicum https://wiki.freebsd.org/Capsicum
  • trasz 4y ago
    It’s not really more complicated; it’s just that Capsicum implements an actual security model instead of a random hodgepodge, like with seccmp or pledge, and that means one has to fit the application into that model.
  • gnufx 4y ago
    Unfortunately the Linux port was never incorporated and is apparently now abandoned: https://github.com/google/capsicum-linux https://github.com/google/capsicum-linux Then, if you're serious about capabilities, as you should be more-or-less, you might want Genode (posted here fairly recently) or something else, where they're not grafted in.