4 ms·
How so? Obviously this is ineffective at the package level but if the thing spawning these processes, like the GitHub runners or Node itself added support to en
by hypeatei 2y ago
How so? Obviously this is ineffective at the package level but if the thing spawning these processes, like the GitHub runners or Node itself added support to enter a "restricted" mode and pledged then that would help, no?
- _flux 2y agoAccording to https://www.openbsd.org/papers/eurobsdcon2017-pledge.pdf https://www.openbsd.org/papers/eurobsdcon2017-pledge.pdf pledge turns off upon execve. Surely it would be quite limiting for runners to use it. As far as I see its purpose is mostly a mitigation/self-defence for vulnerabilities in C-based apps, so basically limiting what happens once the attacker has exploited a vulnerability. Maybe it has other uses. It could be used defending against bugs in the Node runtime itself, as you say, but as I understand vulnerabilities in the Node runtime itself are quite rare, so more fine-grained limitations could be implemented within itself.
- ratmice 2y agoI'm not much of an openbsd user, but I have been meaning to understand if this is the hole execpromises is intended to fill. At the very least, I think execpromises was added a year after the documentation that you linked, so it's worth looking into.