3 ms·
>Hiding filesystems is security via obscurity more than anything else, and probably won't hold up if someone has root. That statement indicates you do not full
by jmclnx 4y ago
>Hiding filesystems is security via obscurity more than anything else, and probably won't hold up if someone has root.
That statement indicates you do not fully understand pledge(2) and unveil(2).
For example, if you are running Firefox using the default settings as root on OpenBSD. Firefox will not be able to see anything outside of the directories allowed by unveil(2). So an errant JS will not be able to peruse "veiled" Directories. For instance, Firefox cannot see any data in ~/.ssh no matter what ID you are using.
- Zurrrrr 4y ago> That statement indicates you do not fully understand pledge(2) and unveil(2). Not so, not so at all. You have to take my statement in context. The point was those technologies, while nifty, are entirely irrelevant if an attacker gains remote root.
- bentley 4y agoOpenBSD’s heavy use of pledge, unveil, privilege separation, unprivileged processes, chroot, and strong memory protections do an excellent job of keeping attackers from gaining root.
- Zurrrrr 4y agoA car can have all the tech in the world to avoid an accident, but I still expect it to have seatbelts.