4 ms·

As far as I know, all of these statements are still true: https://web.archive.org/web/20220227172102/https://madaidans-insecurities.github.io/openbsd.html http

• yjftsjthsd-h 3y ago
  > OpenBSD has no Mandatory Access Control (MAC) system like AppArmor or SELinux which prevents you from fully locking down user space. Isn't that pledge? And in general, I observe that lots of people are happy to say that OpenBSD's protections are no good, but somehow they can't be bothered to actually show a working exploit.
  • MuffinFlavored 3y ago
    > > OpenBSD has no Mandatory Access Control (MAC) system like AppArmor or SELinux which prevents you from fully locking down user space. Would this have mattered/stopped/mitigated the `xz` problem if systemd spawns opensshd and transiently loads infected .so shared objects?
    • yjftsjthsd-h 3y ago
      I'm not really super confident, but I think the problem is that sshd has to be able to spawn user sessions and those users are generally not supposed to be (meaningfully) confined by selinux or whatever. So I suspect that it wouldn't have helped, because a compromised sshd is necessarily in the prefect place to MitM or forge a session regardless of extra constraints. But take with a grain of salt.
  • sillywalk 3y ago
    AppArmor/SELinux require separate policy files to be written, to describe what an app can/can't do. Pledge/unveil are APIs that developers use to directly restrict what an app can do/can't do.