3 ms·
> and once done don't have to be done again Hardly, you'll have to update the rules when the program gets updated to do new things; whereas with pledge(2)/unve
by commandersaki 4y ago
> and once done don't have to be done again
Hardly, you'll have to update the rules when the program gets updated to do new things; whereas with pledge(2)/unveil(2) the developer simply applies more restrictions if needed before the program is distributed.
pledge(2)/unveil(2) is not only superior because it cannot be disabled, it has better aesthetics than any of that apparmor/selinux garbage.
- Zurrrrr 4y agoOn most servers, programs are not doing drastically new things. That really isn't the issue you make it out to be. The developer applying restrictions ahead of time can't, by nature, mitigate the types of bugs that things like SELinux can protect against. You really have no clue about what you're talking about.