3 ms·

> Can you refer to any sandboxing solution or technologies that limit themselves to restricting syscalls and hiding file paths? FreeBSD has capsicum and Linux

> Can you refer to any sandboxing solution or technologies that limit themselves to restricting syscalls and hiding file paths? FreeBSD has capsicum and Linux has seccomp-bpf & landlock. Of the three, pledge and unveil are the least horrible execution of the same idea (though capsicum is alright, too). Obviously it's not a "run any random machine code on my system safely" type of sandbox, rather it's used by e.g. browsers as defense in depth so that attackers can't just outright call execl.

ruthmarx 2y ago
> Of the three, pledge and unveil are the least horrible execution of the same idea I don't think they are the same idea though. pledge and unveil are significantly more limited in scope. > Obviously it's not a "run any random machine code on my system safely" type of sandbox That's pretty much what a sandbox is though. Not every limitation or security augmentation is a sandbox, nor does it have to be.
- shiomiru 2y ago
  > I don't think they are the same idea though. pledge and unveil are significantly more limited in scope. The "idea" I'm talking about is privilege dropping. But sure, you can also use seccomp for other things. > That's pretty much what a sandbox is though. Not every limitation or security augmentation is a sandbox, nor does it have to be. seccomp-bpf and pledge are both tools used to implement sandboxes in browsers.[1][2] Maybe you don't like this terminology, but it is quite well established at this point. [1]: https://wiki.mozilla.org/Security/Sandbox/Seccomp https://wiki.mozilla.org/Security/Sandbox/Seccomp [2]: https://www.openbsd.org/papers/eurobsdcon2022-landry-taming_the_fox.md https://www.openbsd.org/papers/eurobsdcon2022-landry-taming_...
  - ruthmarx 2y ago
    > The "idea" I'm talking about is privilege dropping. OK. But privilege dropping alone does not a sandbox make. > seccomp-bpf and pledge are both tools used to implement sandboxes in browsers.[1][2] Maybe you don't like this terminology, but it is quite well established at this point. A browser sandbox is quite a different thing from an OS level sandbox, which is the context we are discussing sandboxes in.

ruthmarx 2y ago

> Of the three, pledge and unveil are the least horrible execution of the same idea I don't think they are the same idea though. pledge and unveil are significantly more limited in scope. > Obviously it's not a "run any random machine code on my system safely" type of sandbox That's pretty much what a sandbox is though. Not every limitation or security augmentation is a sandbox, nor does it have to be.

shiomiru 2y ago
> I don't think they are the same idea though. pledge and unveil are significantly more limited in scope. The "idea" I'm talking about is privilege dropping. But sure, you can also use seccomp for other things. > That's pretty much what a sandbox is though. Not every limitation or security augmentation is a sandbox, nor does it have to be. seccomp-bpf and pledge are both tools used to implement sandboxes in browsers.[1][2] Maybe you don't like this terminology, but it is quite well established at this point. [1]: https://wiki.mozilla.org/Security/Sandbox/Seccomp https://wiki.mozilla.org/Security/Sandbox/Seccomp [2]: https://www.openbsd.org/papers/eurobsdcon2022-landry-taming_the_fox.md https://www.openbsd.org/papers/eurobsdcon2022-landry-taming_...
- ruthmarx 2y ago
  > The "idea" I'm talking about is privilege dropping. OK. But privilege dropping alone does not a sandbox make. > seccomp-bpf and pledge are both tools used to implement sandboxes in browsers.[1][2] Maybe you don't like this terminology, but it is quite well established at this point. A browser sandbox is quite a different thing from an OS level sandbox, which is the context we are discussing sandboxes in.