5 ms·

FreeBSD Capsicum vs. Linux Seccomp Process Sandboxing

125 points by vermaden 7mo ago

PeterWhittaker 7mo ago
Interesting article, but it compares apples to a fruit stand: The approach could be improved by comparing Capsicum to using seccomp in the same way. Sometime ago I wrote a library for a customer that did exactly that: Open a number of resources, e.g., stdin, stdout, stderr, a pipe or two, a socket or two, make the seccomp calls necessary to restrict the use of read/write/etc. to the associated file descriptors, then lock out all other system calls - which includes seccomp-related calls. Basically, the library took a very Capsicum-like approach of whitelisting specific actions then sealing itself against further changes. This is a LOT of work, of course, and the available APIs don't make it particularly easy or elegant, but it is definitely doable. I chose this approach because the docker whitelist approach was far too open ended and "uncurated", if you will, for the use-case we were targeting. In this particular case, I was aided by the fact the library was written to support the very specific use-case of filters running in containers using FIFOs for IPC, logging, and reporting: Every filter saw exactly the same interfaces to the world, so it was relatively easier to lock things down. Having said that, I wish Linux had a Capsicum-equivalent call, or, even better for the approach I took, a friendlier way to whitelist specific calls.
- thomashabets2 7mo ago
  A problem with that approach is that libc can after an upgrade decide to start doing syscalls you were not expecting. Like the first time you call `printf()` it calls `newfstatat()`. Only the first time. Maybe in the future it'll call it more often than that, and then your binary breaks. I'm not sure what glibc's latest policy is on linking statically, but at least it used to be basically unsupported and bugs about it were ignored. But even if supported, you can't know if it under some configurations or runtime circumstances uses dlopen for something. Or maybe once you juggle more than X file descriptors some code switches from using `poll()` to using `select()` (or `epoll()`). My thoughts last time I looked at seccomp: https://blog.habets.se/2022/03/seccomp-unsafe-at-any-speed.html https://blog.habets.se/2022/03/seccomp-unsafe-at-any-speed.h...
  - chuckadams 7mo ago
    Now that Landlock actually is a thing, have you considered writing another followup? Given what I've seen of landlock, I expect it'll be spicy...
    - WalterGR 7mo ago
      I took the bait. “The goal of Landlock is to enable restriction of ambient rights (e.g. global filesystem or network access) for a set of processes. Because Landlock is a stackable LSM [(Linux Security Model)], it makes it possible to create safe security sandboxes as new security layers in addition to the existing system-wide access-controls. ... Landlock empowers any process, including unprivileged ones, to securely restrict themselves.” https://docs.kernel.org/userspace-api/landlock.html https://docs.kernel.org/userspace-api/landlock.html
    - thomashabets2 7mo ago
      I've actually found it pretty fine. It doesn't have full coverage, but they have a system of adding coverage (ABI versions), and it covers a lot of the important stuff. The one restriction I'm not sure about is that you can't say "~/ except ~/.gnupg". You have to actually enumerate everything you do want to allow. But maybe that's for the best. Both because it mandates rules not becoming too complex to reason about, and because that's a weird requirement in general. Like did you really mean to give access to ~/.gnupg.backup/? Probably not. Probably best to enumerate the allowlist. And if you really want to, I guess you can listdir() and compose the exhaustive list manually, after subtracting the "except X". I find seccomp unusable and not fit for purpose, but landlock closes many doors. Maybe you know better? I'd love to hear your take.
      - chuckadams 7mo ago
        I definitely don't know better, and after taking a few more looks at landlock, I'm not even sure what my objections were, probably got it confused with something else entirely. Confusion and ignorance on my part I guess.
  - Someone 7mo ago
- hrmtst93837 7mo ago
  [flagged]
jmclnx 7mo ago
This site is a perfect example showing why people are complaining about grey text, to me it is unreadable. See: https://news.ycombinator.com/item?id=47268574 https://news.ycombinator.com/item?id=47268574
- szszrk 7mo ago
  I can't read it normally even on 300% zoom. Somehow even reading mode is broken, due to diagrams being rendered in browser - I did not expect that. But hey, it's a game!
  - icedchai 7mo ago
    The font and color combination is terrible. It looks blurry to me, even at high zoom.
    - szszrk 7mo ago
      Game in background doesn't help either. It reminds me the pinnacle of design - Microsoft Authenticator. On Android, out of the blue, it displays global overlay to select one of the 3 numbers to confirm login. The overlay is ... transparent.
- jajuuka 7mo ago
  The game happening at the same time is just distraction central too.
- littlestymaar 7mo ago
  You're not missing anything, the entire blog is AI slop.
  - szszrk 7mo ago
    I'd love to hear this explained. Deeply. The UI is fun but unreadable, but content is solid. Explain how this is slop please.
thomashabets2 7mo ago
Yeah I'm not a fan of seccomp (https://blog.habets.se/2022/03/seccomp-unsafe-at-any-speed.html https://blog.habets.se/2022/03/seccomp-unsafe-at-any-speed.h...). On Linux I understand that Landlock is the way to go.
- 0x457 7mo ago
  Landlock right now doesn't offer a lot for things that aren't file system access. Other than that it's great, you can have different restrictions per-thread if you want to.
  - thomashabets2 7mo ago
    Yeah, but the file system is where I put most of my files. :-) Between file system, bind/connect, and sending signals, that covers most of it. Probably the biggest remaining risk is any unpatched bugs in the kernel itself. So one would need to first gain execution in the process, and then elevate that access inside the kernel, in a way that doesn't just grant you root but still Landlocked, and with a much smaller effective syscall attack surface. Like even if there's a kernel bug in ioctl on devs, landlock can turn that off too.
    - 0x457 7mo ago
      I agree, but it would be nice if it had similar fine-grained APIs for network calls. That said I solved it by using LD_PRELOAD and socks5. It's not perfect, but good enough. Landlock is one of my favorite linux-only APIs almost feels like it was FreeBSD's answer to some Linux feature.
littlestymaar 7mo ago
I've seen AI written blog posts before, but this is one step above: the entire blog (~90 articles) have been AI generated over the past three months. I already find it very frustrating that most open source projects spawning on HN's front page are resume-boosting AI slop but if blogs start being the same the internet is definitely dead. Edit: it doesn't even looks like it's resume-boosting in this case, the “person” behind it doesn't even appear to exist. We can only speculate about the intent behind this.
- shirro 7mo ago
  It is getting more difficult to research now. Increasingly I just grab the source code locally and don't bother with the browser. Every search returns pages of wordy AI generated docs. At best they restate the code. At worse they read like badly written brochures. I am avoiding any project that doesn't have a long history. Large, feature packed projects that appeared out of nowhere on github with a single commit with no history or users are essentially stolen code that has been machine translated to obscure the original authors works. I hate becoming the old person shaking their fist at the sky but the AI bros have just gone too far. I don't know why there isn't a bigger political and social movement against them. I would sign up in an instant to see their companies and practices regulated out of existence.
- renox 7mo ago
  And the Chrome capsicum hallucination got me..
- smartbit 7mo ago
  The person https://www.linkedin.com/in/vvoss/ https://www.linkedin.com/in/vvoss/ seems to exist, I even have a mutual linkedin connection. What makes you think the “person” behind it doesn't even appear to exist?
  - littlestymaar 7mo ago
    I can't log-in to linkedin right now, but here's a few things: - the profile picture is almost certainly (like 99%, certainty) AI-generated (I can even tell you it's ChatGPT-generated, the style is way too characteristic to miss). - the LinkedIn profile shows prolific activity for the past few days, but almost nothing before that, I'm not sure the profile existed before. - the github account is just 2 weeks old. Having a mutual connection doesn't mean much, the interesting question would be who's the mutual and for how long has he be a connection. It's not hard to get to 500 LinkedIn connections on LinkedIn in a few days, you just need to add headhunters and other hiring specialists, they'll never refuse an invitation from a profile that look interesting. They could also have added someone who interacted with their LinkedIn slop submission, making the person more likely to accept the invitation.
thedatamonger 7mo ago
so .. if i'm getting this right, this is an article about security, but the author can't be bothered to configure https correctly?
- craftkiller 7mo ago
  What'd they get wrong? Firefox and curl aren't reporting any TLS errors for me.
  - thedatamonger 7mo ago
    $ dig vivianvoss.net A +short @ns11.infomaniak.ch. 78.46.78.181 $ curl -v https://vivianvoss.net/ https://vivianvoss.net/ 2>&1 | tail -3 * OpenSSL/3.0.13: error:0A00010B:SSL routines::wrong version number * Closing connection curl: (35) OpenSSL/3.0.13: error:0A00010B:SSL routines::wrong version number $ curl -v http://vivianvoss.net/ http://vivianvoss.net/ 2>&1 | grep Location < Location: https://www.safebrowse.io/warn.html?url=http://vivianvoss.net/&token=0bb29fa7 https://www.safebrowse.io/warn.html?url=http://vivianvoss.ne... $ whois 78.46.78.181 | grep -i netname netname: HETZNER-RZ-NBG-NET $ host 78.46.78.181 181.78.46.78.in-addr.arpa domain name pointer min2max.run. The domain's authoritative nameserver (Infomaniak) points vivianvoss.net at 78.46.78.181 — a Hetzner box in Germany with rDNS min2max.run. That server redirects HTTP to SafeBrowse.io and responds to TLS handshakes with garbage. Not a local issue, not a DNS hijack — the A record itself is wrong.
    - craftkiller 7mo ago
      Hmm so oddly enough this works fine for me: $ curl -v https://vivianvoss.net/ 2>&1 | tail -3 <script src="/assets/scripts/perf.js"></script> </body> </html> And the logs show it is going to the same address: * Established connection to vivianvoss.net (78.46.78.181 port 443) from 172.16.245.55 port 36208 Any chance you're a comcast xfinity customer? Searching for safebrowse.io shows that xfinity "advanced security" does this whole redirect to safebrowse.io. -- Unrelated, but the site also returns an AAAA record for an ipv6 address that does not work. So they've misconfigured their server in that regard. $ drill vivianvoss.net AAAA @1.1.1.1 [...] vivianvoss.net. 3600 IN AAAA 2a01:4f8:120:34ad::1 [...] $ curl --header 'Host: vivianvoss.net' 'https://[2a01:4f8:120:34ad::1]:443' <hangs forever> $ curl https://ipv6.google.com <works immediately>
adiabatichottub 7mo ago
One question I've always had about these capability systems is: why isn't there a way to set capabilities from the parent process when execing? Why trust a program to set its own capabilities? I know that having a process set capabilities on itself doesn't break existing tools, but it seems like if you really wanted a robust system it would make sense to have the parent process, the user's shell for example, set the capabilities on its children, and have those capabilities be inheritable so the child could spawn other processes with the same or fewer capabilities (if it's allowed to do that at all). Is there an existing system that works this way, in or outside of the UNIX family? Or maybe some research paper written on the subject? I'd love to know.
- toast0 7mo ago
  I've only really messed with capsicum. You can certainly cap_enter between fork and exec, but depending on exactly what your target does, it's really not simple to do anything meaningful beyond the basic capsicum mode without changes to the program. The way capabilities usually work is you more or less turn off the usual do whatever you want syscalls, and have to do restricted things through FDs that have the capability to do them. So like, no more open any path, you have to use openat with a FD in your directory of interest. But that requires the program to understand how to use the capabilities and how to be passed them. It's not something that you can just impose. My understanding of SELinux, is it can be imposed on a program without the knowledge of the program, because it's more or less matching rules for syscalls... rather than giving a restricted FD to use with openat, you restrict the options for open.
- black_knight 7mo ago
  Answering without reading TFA here. But I am familiar with capsicum. But I am pretty sure you CAN get your capabilities from a patent process using capsicum, since they are just file descriptors.
- harporoeder 7mo ago
  This is essentially what containers are. Bubblewrap / Docker / Podman. I think the primary issue is very few applications on Desktop systems are actually designed with sandboxing in mind unlike say something on a phone.
brynet 7mo ago
EDIT: Article seems to have been updated to remove mention of Chromium. This article contains a lot of errors, for example Chromium on FreeBSD does NOT use Capsicum, it never has. That was experimental and invasive work done 17 years ago that was NEVER committed to their official ports repository. In fact, not a single browser on FreeBSD uses Capsicum or any form of sandboxing _at all_. https://github.com/rwatson/chromium-capsicum https://github.com/rwatson/chromium-capsicum https://www.freshports.org/www/chromium/ https://www.freshports.org/www/chromium/ https://cgit.freebsd.org/ports/log/www/chromium/Makefile?qt=grep&q=capsicum https://cgit.freebsd.org/ports/log/www/chromium/Makefile?qt=... Contrast that with OpenBSD, where the Chromium port has used pledge(2) since January 2016, and unveil(2) since 2018. Both are enabled by default. Mozilla Firefox ports also use both pledge and unveil since 2018-2019, with refinements over the years. https://marc.info/?l=openbsd-ports-cvs&m=145211683609002&w=2 https://marc.info/?l=openbsd-ports-cvs&m=145211683609002&w=2 https://marc.info/?l=openbsd-ports-cvs&m=153250162128188&w=2 https://marc.info/?l=openbsd-ports-cvs&m=153250162128188&w=2 OpenBSD's fork of tcpdump has been privsep for ~22 years, and its packet parser runs with no privileges. It's pledged tightly "stdio" and has no network/filesystem access, and uses OpenBSD specific innovations like bpf descriptor locking (BIOCLOCK) missing from both FreeBSD/Linux tcpdump today (despite FreeBSD adding the ioctl in 2005). In the years since it was added, the reason Capsicum has only been applied to a handful of utilities is because it's a tree barren of decades worth of incremental work on privilege separation and security research.
- limagnolia 7mo ago
  I would like to see a comparison of capsicum and pledge/unveil. Is capsicum much more difficult to use? Is it inherently less secure?
  - brynet 7mo ago
    It's very difficult to reason about, for instance compare the OpenSSH sshd sandbox implementations. https://github.com/openssh/openssh-portable/blob/master/sshd-auth.c#L209 https://github.com/openssh/openssh-portable/blob/master/sshd... https://github.com/openssh/openssh-portable/blob/master/sandbox-darwin.c#L64 https://github.com/openssh/openssh-portable/blob/master/sand... https://github.com/openssh/openssh-portable/blob/master/sandbox-seccomp-filter.c https://github.com/openssh/openssh-portable/blob/master/sand... https://github.com/openssh/openssh-portable/blob/master/sandbox-solaris.c https://github.com/openssh/openssh-portable/blob/master/sand... w/ Capsicum, beyond faffing around with some file descriptors, it's unclear what security cap_enter() adds: https://github.com/openssh/openssh-portable/blob/master/sandbox-capsicum.c https://github.com/openssh/openssh-portable/blob/master/sand...
ruslan 7mo ago
Excuse me for being ignorant, is Seccomp what SELinux is based on ? Also, what is well-known piece of software that uses Capsicum on FreeBSD ? Can someone name a few ?
- gizmo686 7mo ago
  No. SELinux is based on the Linux Security Module framework, which places explicit hooks at key points within the kernel. They also operate under pretty fundamentally different philosophies. Seccomp is based on a program dropping its own permissions. SELinux is based on a system integrator writing an ahead of time policy restricting what a program can do.
_slih 7mo ago
subtraction vs filtration is the right framing even if the article is slop. removing capabilities is structurally different from filtering syscalls because the set of things to filter grows every kernel release but the set of things a process actually needs doesn't.

125 points by vermaden 7mo ago

Interesting article, but it compares apples to a fruit stand: The approach could be improved by comparing Capsicum to using seccomp in the same way. Sometime ago I wrote a library for a customer that did exactly that: Open a number of resources, e.g., stdin, stdout, stderr, a pipe or two, a socket or two, make the seccomp calls necessary to restrict the use of read/write/etc. to the associated file descriptors, then lock out all other system calls - which includes seccomp-related calls. Basically, the library took a very Capsicum-like approach of whitelisting specific actions then sealing itself against further changes. This is a LOT of work, of course, and the available APIs don't make it particularly easy or elegant, but it is definitely doable. I chose this approach because the docker whitelist approach was far too open ended and "uncurated", if you will, for the use-case we were targeting. In this particular case, I was aided by the fact the library was written to support the very specific use-case of filters running in containers using FIFOs for IPC, logging, and reporting: Every filter saw exactly the same interfaces to the world, so it was relatively easier to lock things down. Having said that, I wish Linux had a Capsicum-equivalent call, or, even better for the approach I took, a friendlier way to whitelist specific calls.

thomashabets2 7mo ago
A problem with that approach is that libc can after an upgrade decide to start doing syscalls you were not expecting. Like the first time you call `printf()` it calls `newfstatat()`. Only the first time. Maybe in the future it'll call it more often than that, and then your binary breaks. I'm not sure what glibc's latest policy is on linking statically, but at least it used to be basically unsupported and bugs about it were ignored. But even if supported, you can't know if it under some configurations or runtime circumstances uses dlopen for something. Or maybe once you juggle more than X file descriptors some code switches from using `poll()` to using `select()` (or `epoll()`). My thoughts last time I looked at seccomp: https://blog.habets.se/2022/03/seccomp-unsafe-at-any-speed.html https://blog.habets.se/2022/03/seccomp-unsafe-at-any-speed.h...
- chuckadams 7mo ago
  Now that Landlock actually is a thing, have you considered writing another followup? Given what I've seen of landlock, I expect it'll be spicy...
  - WalterGR 7mo ago
    I took the bait. “The goal of Landlock is to enable restriction of ambient rights (e.g. global filesystem or network access) for a set of processes. Because Landlock is a stackable LSM [(Linux Security Model)], it makes it possible to create safe security sandboxes as new security layers in addition to the existing system-wide access-controls. ... Landlock empowers any process, including unprivileged ones, to securely restrict themselves.” https://docs.kernel.org/userspace-api/landlock.html https://docs.kernel.org/userspace-api/landlock.html
  - thomashabets2 7mo ago
    I've actually found it pretty fine. It doesn't have full coverage, but they have a system of adding coverage (ABI versions), and it covers a lot of the important stuff. The one restriction I'm not sure about is that you can't say "~/ except ~/.gnupg". You have to actually enumerate everything you do want to allow. But maybe that's for the best. Both because it mandates rules not becoming too complex to reason about, and because that's a weird requirement in general. Like did you really mean to give access to ~/.gnupg.backup/? Probably not. Probably best to enumerate the allowlist. And if you really want to, I guess you can listdir() and compose the exhaustive list manually, after subtracting the "except X". I find seccomp unusable and not fit for purpose, but landlock closes many doors. Maybe you know better? I'd love to hear your take.
    - chuckadams 7mo ago
      I definitely don't know better, and after taking a few more looks at landlock, I'm not even sure what my objections were, probably got it confused with something else entirely. Confusion and ignorance on my part I guess.
- Someone 7mo ago
hrmtst93837 7mo ago
[flagged]

jmclnx 7mo ago

This site is a perfect example showing why people are complaining about grey text, to me it is unreadable. See: https://news.ycombinator.com/item?id=47268574 https://news.ycombinator.com/item?id=47268574

szszrk 7mo ago
I can't read it normally even on 300% zoom. Somehow even reading mode is broken, due to diagrams being rendered in browser - I did not expect that. But hey, it's a game!
- icedchai 7mo ago
  The font and color combination is terrible. It looks blurry to me, even at high zoom.
  - szszrk 7mo ago
    Game in background doesn't help either. It reminds me the pinnacle of design - Microsoft Authenticator. On Android, out of the blue, it displays global overlay to select one of the 3 numbers to confirm login. The overlay is ... transparent.
jajuuka 7mo ago
The game happening at the same time is just distraction central too.
littlestymaar 7mo ago
You're not missing anything, the entire blog is AI slop.
- szszrk 7mo ago
  I'd love to hear this explained. Deeply. The UI is fun but unreadable, but content is solid. Explain how this is slop please.

thomashabets2 7mo ago

Yeah I'm not a fan of seccomp (https://blog.habets.se/2022/03/seccomp-unsafe-at-any-speed.html https://blog.habets.se/2022/03/seccomp-unsafe-at-any-speed.h...). On Linux I understand that Landlock is the way to go.

0x457 7mo ago
Landlock right now doesn't offer a lot for things that aren't file system access. Other than that it's great, you can have different restrictions per-thread if you want to.
- thomashabets2 7mo ago
  Yeah, but the file system is where I put most of my files. :-) Between file system, bind/connect, and sending signals, that covers most of it. Probably the biggest remaining risk is any unpatched bugs in the kernel itself. So one would need to first gain execution in the process, and then elevate that access inside the kernel, in a way that doesn't just grant you root but still Landlocked, and with a much smaller effective syscall attack surface. Like even if there's a kernel bug in ioctl on devs, landlock can turn that off too.
  - 0x457 7mo ago
    I agree, but it would be nice if it had similar fine-grained APIs for network calls. That said I solved it by using LD_PRELOAD and socks5. It's not perfect, but good enough. Landlock is one of my favorite linux-only APIs almost feels like it was FreeBSD's answer to some Linux feature.

littlestymaar 7mo ago

I've seen AI written blog posts before, but this is one step above: the entire blog (~90 articles) have been AI generated over the past three months. I already find it very frustrating that most open source projects spawning on HN's front page are resume-boosting AI slop but if blogs start being the same the internet is definitely dead. Edit: it doesn't even looks like it's resume-boosting in this case, the “person” behind it doesn't even appear to exist. We can only speculate about the intent behind this.

shirro 7mo ago
It is getting more difficult to research now. Increasingly I just grab the source code locally and don't bother with the browser. Every search returns pages of wordy AI generated docs. At best they restate the code. At worse they read like badly written brochures. I am avoiding any project that doesn't have a long history. Large, feature packed projects that appeared out of nowhere on github with a single commit with no history or users are essentially stolen code that has been machine translated to obscure the original authors works. I hate becoming the old person shaking their fist at the sky but the AI bros have just gone too far. I don't know why there isn't a bigger political and social movement against them. I would sign up in an instant to see their companies and practices regulated out of existence.
renox 7mo ago
And the Chrome capsicum hallucination got me..
smartbit 7mo ago
The person https://www.linkedin.com/in/vvoss/ https://www.linkedin.com/in/vvoss/ seems to exist, I even have a mutual linkedin connection. What makes you think the “person” behind it doesn't even appear to exist?
- littlestymaar 7mo ago
  I can't log-in to linkedin right now, but here's a few things: - the profile picture is almost certainly (like 99%, certainty) AI-generated (I can even tell you it's ChatGPT-generated, the style is way too characteristic to miss). - the LinkedIn profile shows prolific activity for the past few days, but almost nothing before that, I'm not sure the profile existed before. - the github account is just 2 weeks old. Having a mutual connection doesn't mean much, the interesting question would be who's the mutual and for how long has he be a connection. It's not hard to get to 500 LinkedIn connections on LinkedIn in a few days, you just need to add headhunters and other hiring specialists, they'll never refuse an invitation from a profile that look interesting. They could also have added someone who interacted with their LinkedIn slop submission, making the person more likely to accept the invitation.

thedatamonger 7mo ago

so .. if i'm getting this right, this is an article about security, but the author can't be bothered to configure https correctly?

craftkiller 7mo ago
What'd they get wrong? Firefox and curl aren't reporting any TLS errors for me.
- thedatamonger 7mo ago
  $ dig vivianvoss.net A +short @ns11.infomaniak.ch. 78.46.78.181 $ curl -v https://vivianvoss.net/ https://vivianvoss.net/ 2>&1 | tail -3 * OpenSSL/3.0.13: error:0A00010B:SSL routines::wrong version number * Closing connection curl: (35) OpenSSL/3.0.13: error:0A00010B:SSL routines::wrong version number $ curl -v http://vivianvoss.net/ http://vivianvoss.net/ 2>&1 | grep Location < Location: https://www.safebrowse.io/warn.html?url=http://vivianvoss.net/&token=0bb29fa7 https://www.safebrowse.io/warn.html?url=http://vivianvoss.ne... $ whois 78.46.78.181 | grep -i netname netname: HETZNER-RZ-NBG-NET $ host 78.46.78.181 181.78.46.78.in-addr.arpa domain name pointer min2max.run. The domain's authoritative nameserver (Infomaniak) points vivianvoss.net at 78.46.78.181 — a Hetzner box in Germany with rDNS min2max.run. That server redirects HTTP to SafeBrowse.io and responds to TLS handshakes with garbage. Not a local issue, not a DNS hijack — the A record itself is wrong.
  - craftkiller 7mo ago
    Hmm so oddly enough this works fine for me: $ curl -v https://vivianvoss.net/ 2>&1 | tail -3 <script src="/assets/scripts/perf.js"></script> </body> </html> And the logs show it is going to the same address: * Established connection to vivianvoss.net (78.46.78.181 port 443) from 172.16.245.55 port 36208 Any chance you're a comcast xfinity customer? Searching for safebrowse.io shows that xfinity "advanced security" does this whole redirect to safebrowse.io. -- Unrelated, but the site also returns an AAAA record for an ipv6 address that does not work. So they've misconfigured their server in that regard. $ drill vivianvoss.net AAAA @1.1.1.1 [...] vivianvoss.net. 3600 IN AAAA 2a01:4f8:120:34ad::1 [...] $ curl --header 'Host: vivianvoss.net' 'https://[2a01:4f8:120:34ad::1]:443' <hangs forever> $ curl https://ipv6.google.com <works immediately>

adiabatichottub 7mo ago

One question I've always had about these capability systems is: why isn't there a way to set capabilities from the parent process when execing? Why trust a program to set its own capabilities? I know that having a process set capabilities on itself doesn't break existing tools, but it seems like if you really wanted a robust system it would make sense to have the parent process, the user's shell for example, set the capabilities on its children, and have those capabilities be inheritable so the child could spawn other processes with the same or fewer capabilities (if it's allowed to do that at all). Is there an existing system that works this way, in or outside of the UNIX family? Or maybe some research paper written on the subject? I'd love to know.

toast0 7mo ago
I've only really messed with capsicum. You can certainly cap_enter between fork and exec, but depending on exactly what your target does, it's really not simple to do anything meaningful beyond the basic capsicum mode without changes to the program. The way capabilities usually work is you more or less turn off the usual do whatever you want syscalls, and have to do restricted things through FDs that have the capability to do them. So like, no more open any path, you have to use openat with a FD in your directory of interest. But that requires the program to understand how to use the capabilities and how to be passed them. It's not something that you can just impose. My understanding of SELinux, is it can be imposed on a program without the knowledge of the program, because it's more or less matching rules for syscalls... rather than giving a restricted FD to use with openat, you restrict the options for open.
black_knight 7mo ago
Answering without reading TFA here. But I am familiar with capsicum. But I am pretty sure you CAN get your capabilities from a patent process using capsicum, since they are just file descriptors.
harporoeder 7mo ago
This is essentially what containers are. Bubblewrap / Docker / Podman. I think the primary issue is very few applications on Desktop systems are actually designed with sandboxing in mind unlike say something on a phone.

brynet 7mo ago

EDIT: Article seems to have been updated to remove mention of Chromium. This article contains a lot of errors, for example Chromium on FreeBSD does NOT use Capsicum, it never has. That was experimental and invasive work done 17 years ago that was NEVER committed to their official ports repository. In fact, not a single browser on FreeBSD uses Capsicum or any form of sandboxing _at all_. https://github.com/rwatson/chromium-capsicum https://github.com/rwatson/chromium-capsicum https://www.freshports.org/www/chromium/ https://www.freshports.org/www/chromium/ https://cgit.freebsd.org/ports/log/www/chromium/Makefile?qt=grep&q=capsicum https://cgit.freebsd.org/ports/log/www/chromium/Makefile?qt=... Contrast that with OpenBSD, where the Chromium port has used pledge(2) since January 2016, and unveil(2) since 2018. Both are enabled by default. Mozilla Firefox ports also use both pledge and unveil since 2018-2019, with refinements over the years. https://marc.info/?l=openbsd-ports-cvs&m=145211683609002&w=2 https://marc.info/?l=openbsd-ports-cvs&m=145211683609002&w=2 https://marc.info/?l=openbsd-ports-cvs&m=153250162128188&w=2 https://marc.info/?l=openbsd-ports-cvs&m=153250162128188&w=2 OpenBSD's fork of tcpdump has been privsep for ~22 years, and its packet parser runs with no privileges. It's pledged tightly "stdio" and has no network/filesystem access, and uses OpenBSD specific innovations like bpf descriptor locking (BIOCLOCK) missing from both FreeBSD/Linux tcpdump today (despite FreeBSD adding the ioctl in 2005). In the years since it was added, the reason Capsicum has only been applied to a handful of utilities is because it's a tree barren of decades worth of incremental work on privilege separation and security research.

limagnolia 7mo ago
I would like to see a comparison of capsicum and pledge/unveil. Is capsicum much more difficult to use? Is it inherently less secure?
- brynet 7mo ago
  It's very difficult to reason about, for instance compare the OpenSSH sshd sandbox implementations. https://github.com/openssh/openssh-portable/blob/master/sshd-auth.c#L209 https://github.com/openssh/openssh-portable/blob/master/sshd... https://github.com/openssh/openssh-portable/blob/master/sandbox-darwin.c#L64 https://github.com/openssh/openssh-portable/blob/master/sand... https://github.com/openssh/openssh-portable/blob/master/sandbox-seccomp-filter.c https://github.com/openssh/openssh-portable/blob/master/sand... https://github.com/openssh/openssh-portable/blob/master/sandbox-solaris.c https://github.com/openssh/openssh-portable/blob/master/sand... w/ Capsicum, beyond faffing around with some file descriptors, it's unclear what security cap_enter() adds: https://github.com/openssh/openssh-portable/blob/master/sandbox-capsicum.c https://github.com/openssh/openssh-portable/blob/master/sand...

ruslan 7mo ago

Excuse me for being ignorant, is Seccomp what SELinux is based on ? Also, what is well-known piece of software that uses Capsicum on FreeBSD ? Can someone name a few ?

gizmo686 7mo ago
No. SELinux is based on the Linux Security Module framework, which places explicit hooks at key points within the kernel. They also operate under pretty fundamentally different philosophies. Seccomp is based on a program dropping its own permissions. SELinux is based on a system integrator writing an ahead of time policy restricting what a program can do.

_slih 7mo ago

subtraction vs filtration is the right framing even if the article is slop. removing capabilities is structurally different from filtering syscalls because the set of things to filter grows every kernel release but the set of things a process actually needs doesn't.