3 ms·
>Doesn’t that mean it can’t be used for all the memory used by, say, the JS sandbox which would be a very very tempting target? Multiprocessing is an option he
by PhilipRoman 2y ago
>Doesn’t that mean it can’t be used for all the memory used by, say, the JS sandbox which would be a very very tempting target?
Multiprocessing is an option here. I think chrome uses it extensively, so that might be the play here. You need separate processes for other stuff anyway, like isolation via namespaces.
- masklinn 2y agoYes, in fact in his comments Theo de Raadt specifically says (amongst other things): > experience with mimmutable() says that applications don't do any of it themselves, it is all in execve(), libc initialization, and ld.so. So this is almost never something a process does to itself, it is part of the sandboxing of child processes.