2 ms·
Capsicum is much more intuitive so I think it would be a lot less work to set up without tooling.
by justincormack 13y ago
Capsicum is much more intuitive so I think it would be a lot less work to set up without tooling.
- mjn 13y agoFor a simple case I could write a C wrapper that just drops privileges, but it'd be nice to have a more versatile CLI tool. Doing that in the general case, e.g. letting me specify options like "no network, no writing files except A and B, no reading files except files in this directory, no spawning processes", requires more or less porting something like ppriv(1) and its privilege-specification syntax to FreeBSD, or writing a workalike.