7 ms·
It can also be used by a parent process to limit the functionality of a child process, by calling tame() after fork() and before exec(). I can imagine this bein
by adrusi 11y ago
It can also be used by a parent process to limit the functionality of a child process, by calling tame() after fork() and before exec(). I can imagine this being used with some a "tame" command in the shell to run untrusted programs. Of course I don't know how thorough the sandboxing is, and I wouldn't trust it to make unsafe programs completely safe.
- cnst 11y ago> Of course I don't know how thorough the sandboxing is, and I wouldn't trust it to make unsafe programs completely safe. That's the best part about OpenBSD -- the APIs may not be binary or even source-code compatible between the releases, but the source code is usually as readable and as clear as it gets.
- Athas 11y ago> I can imagine this being used with some a "tame" command in the shell to run untrusted programs. This might not be useful in practice. The inspiration behind tame() is the observation that a program usually needs many more rights at initialisation-time than in its main-loop. Thus, tame()ing a program before it even starts is unlikely to be practical - if you give it enough permissions to successfully start (including whatever is needed for dynamic linking), you may not have reduced its capabilities much.