3 ms·
Well, you can close all file descriptors (except the pipe used for sending the return value back to the parent), re-mmap all files with MAP_PRIVATE, and then us
by wizzwizz4 2y ago
Well, you can close all file descriptors (except the pipe used for sending the return value back to the parent), re-mmap all files with MAP_PRIVATE, and then use SECCOMP_SET_MODE_STRICT to isolate the child process. But at that point, what are you even doing? Probably nothing useful.
If there were a Quick Fix for safety, we'd probably have discovered it by now.
- jmillikin 2y ago> use SECCOMP_SET_MODE_STRICT to isolate the child process. But at that > point, what are you even doing? Probably nothing useful. The classic example of a fully-seccomp'd subprocess is decoding / decompression. If you want to execute ffmpeg on untrusted user input then seccomp is a sandbox that allows full-power SIMD, and the code has no reason to perform syscalls other than read/write to its input/output stream. On the client side there's font shaping, PDF rendering, image decoding -- historically rich hunting grounds for browser CVEs.
- Animats 2y agoThe classic example of a fully-seccomp'd subprocess is decoding / decompression. Yes. I've run JPEG 2000 decoders in a subprocess for that reason.
- WesolyKubeczek 2y agoWell, it seems that lately this kind of task wants to write/mmap to a GPU, and poke at font files and interpret them.