4 ms·

From above your quote: > The only officially-supported operating system is OpenBSD, as this has considerable security features. And below your quote: > This

by e12e 4mo ago

From above your quote: > The only officially-supported operating system is OpenBSD, as this has considerable security features. And below your quote: > This is possible (I think?) with FreeBSD's Capsicum, but Linux's security facilities are a mess, and will take an expert hand to properly secure. It is portable in the sense that it compiles and runs, not in the sense that it has the same security features. I'd love to see pledge/unveil on (upstream) Linux - but I'm not holding my breath.

Bender 4mo ago
Ok that makes more sense, thankyou.
papercrane 4mo ago
> I'd love to see pledge/unveil on (upstream) Linux - but I'm not holding my breath There is Landlock now, I believe it would be possible to implement unveil and pledge on top of that.
- isityettime 4mo ago
  One of HN's favorite hackers has done that: https://justine.lol/pledge/ https://justine.lol/pledge/ There was a discussion here about it a few years ago: https://news.ycombinator.com/item?id=32096801 https://news.ycombinator.com/item?id=32096801
  - maleldil 4mo ago
    > favorite Interesting choice of word
    - isityettime 4mo ago
      She's excellent and her stuff has made it to the front page many times. I love seeing her work come up and I imagine many others here feel the same way.
      - maleldil 4mo ago
        If you're someone who can separate the work from the author, sure. She's a very intelligent person. Many of us can't.
        isityettime 4mo ago
        Fair enough. I didn't know what was supposed to be objectionable about her personally until your last comment made me do some Googling. Bleh. To be honest, I feel like I still don't really know much about who she really is or what real political work she's doing recently, if any. And I kinda don't wanna know anyway; I don't wanna play political blacklist enforcer. But I understand your reaction now. :-\
- e12e 4mo ago
  Apparently someone tried wrapping landlock in unveil: https://clehaxze.tw/gemlog/2022/04-02-landlock-unveil-experimental-unveil2-implementation-for-linux.gmi https://clehaxze.tw/gemlog/2022/04-02-landlock-unveil-experi... https://github.com/marty1885/landlock-unveil https://github.com/marty1885/landlock-unveil
  - e12e 4mo ago
    ... And looks like cosmopolitan libc wraps landlock for unveil, in addition to implement pledge.

by e12e 4mo ago

Bender 4mo ago

Ok that makes more sense, thankyou.

papercrane 4mo ago

> I'd love to see pledge/unveil on (upstream) Linux - but I'm not holding my breath There is Landlock now, I believe it would be possible to implement unveil and pledge on top of that.

isityettime 4mo ago
One of HN's favorite hackers has done that: https://justine.lol/pledge/ https://justine.lol/pledge/ There was a discussion here about it a few years ago: https://news.ycombinator.com/item?id=32096801 https://news.ycombinator.com/item?id=32096801
- maleldil 4mo ago
  > favorite Interesting choice of word
  - isityettime 4mo ago
    She's excellent and her stuff has made it to the front page many times. I love seeing her work come up and I imagine many others here feel the same way.
    - maleldil 4mo ago
      If you're someone who can separate the work from the author, sure. She's a very intelligent person. Many of us can't.
      - isityettime 4mo ago
        Fair enough. I didn't know what was supposed to be objectionable about her personally until your last comment made me do some Googling. Bleh. To be honest, I feel like I still don't really know much about who she really is or what real political work she's doing recently, if any. And I kinda don't wanna know anyway; I don't wanna play political blacklist enforcer. But I understand your reaction now. :-\
e12e 4mo ago
Apparently someone tried wrapping landlock in unveil: https://clehaxze.tw/gemlog/2022/04-02-landlock-unveil-experimental-unveil2-implementation-for-linux.gmi https://clehaxze.tw/gemlog/2022/04-02-landlock-unveil-experi... https://github.com/marty1885/landlock-unveil https://github.com/marty1885/landlock-unveil
- e12e 4mo ago
  ... And looks like cosmopolitan libc wraps landlock for unveil, in addition to implement pledge.