3 ms·

The actual work of porting is matching the security features provided by OpenBSD's pledge(2) and unveil(2). These are critical elements to the functionality of

by Bender 5mo ago

The actual work of porting is matching the security features provided by OpenBSD's pledge(2) and unveil(2). These are critical elements to the functionality of the system. Without them, your system accepts arbitrary data from the public network. https://justine.lol/pledge/ https://justine.lol/pledge/ I am not seeing pledge on Alpine Linux in edge. Have people been testing Pledge on Linux? Did I perhaps misunderstand the risk of using Openrsync without pledge? Or is this article just for OpenBSD users?

e12e 5mo ago
From above your quote: > The only officially-supported operating system is OpenBSD, as this has considerable security features. And below your quote: > This is possible (I think?) with FreeBSD's Capsicum, but Linux's security facilities are a mess, and will take an expert hand to properly secure. It is portable in the sense that it compiles and runs, not in the sense that it has the same security features. I'd love to see pledge/unveil on (upstream) Linux - but I'm not holding my breath.
- Bender 5mo ago
  Ok that makes more sense, thankyou.
- papercrane 5mo ago
  > I'd love to see pledge/unveil on (upstream) Linux - but I'm not holding my breath There is Landlock now, I believe it would be possible to implement unveil and pledge on top of that.
  - isityettime 5mo ago
    One of HN's favorite hackers has done that: https://justine.lol/pledge/ https://justine.lol/pledge/ There was a discussion here about it a few years ago: https://news.ycombinator.com/item?id=32096801 https://news.ycombinator.com/item?id=32096801
    - maleldil 5mo ago
      > favorite Interesting choice of word
      - isityettime 5mo ago
        She's excellent and her stuff has made it to the front page many times. I love seeing her work come up and I imagine many others here feel the same way.
        maleldil 5mo ago
        If you're someone who can separate the work from the author, sure. She's a very intelligent person. Many of us can't.
        isityettime 5mo ago
        Fair enough. I didn't know what was supposed to be objectionable about her personally until your last comment made me do some Googling. Bleh. To be honest, I feel like I still don't really know much about who she really is or what real political work she's doing recently, if any. And I kinda don't wanna know anyway; I don't wanna play political blacklist enforcer. But I understand your reaction now. :-\
  - e12e 5mo ago
    Apparently someone tried wrapping landlock in unveil: https://clehaxze.tw/gemlog/2022/04-02-landlock-unveil-experimental-unveil2-implementation-for-linux.gmi https://clehaxze.tw/gemlog/2022/04-02-landlock-unveil-experi... https://github.com/marty1885/landlock-unveil https://github.com/marty1885/landlock-unveil
    - e12e 5mo ago
      ... And looks like cosmopolitan libc wraps landlock for unveil, in addition to implement pledge.
justinsaccount 5mo ago
that quote seems to be a bit of an oversimplification to the point of being completely wrong. > Without them, your system accepts arbitrary data from the public network. Neither of these features change if you are accepting arbitrary data from the public network. They limit what an exploited process can do. It's explained properly in the 'Security' section, so I'm not sure where this came from.
- Bender 5mo ago
  that quote seems to be a bit of an oversimplification to the point of being completely wrong. Under Portability [1] I don't have access to update that repo. I deleted my accounts when Microsoft took over. [1] - https://github.com/kristapsdz/openrsync https://github.com/kristapsdz/openrsync
saidnooneever 5mo ago
Linux has no such features as pledge or unveil, nor capsicum. it has cgroups, namespaces and a mess ofnother things u need to combine to try and do similar things. (it was built iteratively as many systems interacting and being combined to form 'sandboxing' or isolation/limiting of capabilities rather than specific isolation as an entire concept with specific system calls and kernel paths to enable it). there might be newer stuff in linux land now i see comments about landlock but i assume those will build on the linux primitives rather than whole new ones. - total assumption there but it would seem logical to reuse rather than make new. part of likely what they mean by 'mess' is that its all over the place. many different ways to try and lock things down. hard to pick what is best etc. without thoroughly diving into the different subsystems entirely. (as opposed to just have 1 or 2 relatively simple system calls)
- thomashabets2 5mo ago
  No, landlock is a separate thing. It's the first of its kind on Linux that doesn't completely suck, like seccomp does (https://blog.habets.se/2022/03/seccomp-unsafe-at-any-speed.html https://blog.habets.se/2022/03/seccomp-unsafe-at-any-speed.h...).
  - bagxrvxpepzn 5mo ago
    Sure seccomp has its flaws but it's not unworkable. You could just simply gate execution from running on any newer version of Linux of which you don't have a complete syscall list. Or variations on that theme if you need more flexibility.
    - thomashabets2 5mo ago
      Well, you'll still need to build unveil/pledge on top of it, because it's not just "the version of Linux". It's all libraries used, directly and indirectly (incl config-based list of libraries, like in PAM), and what they suddenly decide to change even in a security-only patch. The list of syscalls any code anywhere in the system calls is not a published contract with any guarantees. > You could just … is doing some heavy lifting here. "You could just" all but guarantee that your program will break in a couple of years for all users who do the responsible thing? Sure, if you're building an appliance with a support contract, where you control everything, then that's doable. Servers/desktops/laptops, not so much.

by Bender 5mo ago

e12e 5mo ago

From above your quote: > The only officially-supported operating system is OpenBSD, as this has considerable security features. And below your quote: > This is possible (I think?) with FreeBSD's Capsicum, but Linux's security facilities are a mess, and will take an expert hand to properly secure. It is portable in the sense that it compiles and runs, not in the sense that it has the same security features. I'd love to see pledge/unveil on (upstream) Linux - but I'm not holding my breath.

Bender 5mo ago
Ok that makes more sense, thankyou.
papercrane 5mo ago
> I'd love to see pledge/unveil on (upstream) Linux - but I'm not holding my breath There is Landlock now, I believe it would be possible to implement unveil and pledge on top of that.
- isityettime 5mo ago
  One of HN's favorite hackers has done that: https://justine.lol/pledge/ https://justine.lol/pledge/ There was a discussion here about it a few years ago: https://news.ycombinator.com/item?id=32096801 https://news.ycombinator.com/item?id=32096801
  - maleldil 5mo ago
    > favorite Interesting choice of word
    - isityettime 5mo ago
      She's excellent and her stuff has made it to the front page many times. I love seeing her work come up and I imagine many others here feel the same way.
      - maleldil 5mo ago
        If you're someone who can separate the work from the author, sure. She's a very intelligent person. Many of us can't.
        isityettime 5mo ago
        Fair enough. I didn't know what was supposed to be objectionable about her personally until your last comment made me do some Googling. Bleh. To be honest, I feel like I still don't really know much about who she really is or what real political work she's doing recently, if any. And I kinda don't wanna know anyway; I don't wanna play political blacklist enforcer. But I understand your reaction now. :-\
- e12e 5mo ago
  Apparently someone tried wrapping landlock in unveil: https://clehaxze.tw/gemlog/2022/04-02-landlock-unveil-experimental-unveil2-implementation-for-linux.gmi https://clehaxze.tw/gemlog/2022/04-02-landlock-unveil-experi... https://github.com/marty1885/landlock-unveil https://github.com/marty1885/landlock-unveil
  - e12e 5mo ago
    ... And looks like cosmopolitan libc wraps landlock for unveil, in addition to implement pledge.

justinsaccount 5mo ago

that quote seems to be a bit of an oversimplification to the point of being completely wrong. > Without them, your system accepts arbitrary data from the public network. Neither of these features change if you are accepting arbitrary data from the public network. They limit what an exploited process can do. It's explained properly in the 'Security' section, so I'm not sure where this came from.

Bender 5mo ago
that quote seems to be a bit of an oversimplification to the point of being completely wrong. Under Portability [1] I don't have access to update that repo. I deleted my accounts when Microsoft took over. [1] - https://github.com/kristapsdz/openrsync https://github.com/kristapsdz/openrsync

saidnooneever 5mo ago

Linux has no such features as pledge or unveil, nor capsicum. it has cgroups, namespaces and a mess ofnother things u need to combine to try and do similar things. (it was built iteratively as many systems interacting and being combined to form 'sandboxing' or isolation/limiting of capabilities rather than specific isolation as an entire concept with specific system calls and kernel paths to enable it). there might be newer stuff in linux land now i see comments about landlock but i assume those will build on the linux primitives rather than whole new ones. - total assumption there but it would seem logical to reuse rather than make new. part of likely what they mean by 'mess' is that its all over the place. many different ways to try and lock things down. hard to pick what is best etc. without thoroughly diving into the different subsystems entirely. (as opposed to just have 1 or 2 relatively simple system calls)

thomashabets2 5mo ago
No, landlock is a separate thing. It's the first of its kind on Linux that doesn't completely suck, like seccomp does (https://blog.habets.se/2022/03/seccomp-unsafe-at-any-speed.html https://blog.habets.se/2022/03/seccomp-unsafe-at-any-speed.h...).
- bagxrvxpepzn 5mo ago
  Sure seccomp has its flaws but it's not unworkable. You could just simply gate execution from running on any newer version of Linux of which you don't have a complete syscall list. Or variations on that theme if you need more flexibility.
  - thomashabets2 5mo ago
    Well, you'll still need to build unveil/pledge on top of it, because it's not just "the version of Linux". It's all libraries used, directly and indirectly (incl config-based list of libraries, like in PAM), and what they suddenly decide to change even in a security-only patch. The list of syscalls any code anywhere in the system calls is not a published contract with any guarantees. > You could just … is doing some heavy lifting here. "You could just" all but guarantee that your program will break in a couple of years for all users who do the responsible thing? Sure, if you're building an appliance with a support contract, where you control everything, then that's doable. Servers/desktops/laptops, not so much.