4 ms·
How come?
by rashkov 3y ago
How come?
- deleted 3y ago[deleted]
- IshKebab 3y agoThey're based on blacklisting rather than whitelisting. Security based on blacklisting means you're always going to forget to ban some critical thing. It's why trying to allow HTML but filter out `<script>` tags never works. An example of whitelisting would be a capability based OS like Fuchsia or a custom non-HTML markup like Markdown that you then allow to use specific safe features like formatting (yeah I know about HTML in Markdown). That said, this approach is probably the best you can do in Linux by a long way. I can definitely see use cases - e.g. all those services that have to use ffmpeg to transcode videos should definitely use something like this.
- jart 3y agoAre you saying this about SECCOMP and Landlock? Just to be clear: - unveil(), based on the Landlock LSM, is a function which whitelists files. - pledge(), based on SECCOMP BPF, is a function which whitelists system calls.
- IshKebab 3y agoYeah, though looking through the code it does actually look very solid. I didn't see that you actually whitelist `/proc/cpuinfo` before.