4 ms·
I was specifically talking about AF_INET dgram sockets, not AF_UNIX; I saw that it wasn't pledged and assumed that was by design (since having that and sendto w
by chc4 3y ago
I was specifically talking about AF_INET dgram sockets, not AF_UNIX; I saw that it wasn't pledged and assumed that was by design (since having that and sendto would be extremely unsafe, since you could connect to abstract unix sockets). If you want to use an inherited unix socket for the blacklisting, you should use SOCK_STREAM unix sockets instead so you can't sendto. Even allowing localhost UDP sockets isn't safe to expose to a sandbox, IMO, since Linux programs fairly often expose privileged operations over those and have no way of knowing the client is supposed to be sandboxed and rejected.
- jart 3y agoI see what you mean now. When we created the "anet" category, the main intent was to prevent redbean from making outbound HTTP connections. Allowing UDP looks like a copy and paste error. You're correct that it is a weakness. Thank you for identifying it! I'm in the process of fixing it now. How would you like to be credited?
- chc4 3y agoJust chc4 is fine, otherwise @sickeningsprawl@infosec.exchange (and Twitter, though I haven't used that in several months).
- jart 3y agoSee https://github.com/jart/cosmopolitan/commit/48b2afb192ec18eca40c0b25603c02a2e3b578e9 https://github.com/jart/cosmopolitan/commit/48b2afb192ec18ec... and https://twitter.com/JustineTunney/status/1670600564164657154 https://twitter.com/JustineTunney/status/1670600564164657154