News for hackers. Stuff that matters.

A comment on Open-sourcing gVisor, a sandboxed container runtime. Parent comment

Re:Open-sourcing gVisor, a sandboxed container runtime by cyphar on Thursday May 03, 2018 @09:05PM (#16991410)
Personally I don't think pledge()'s semantics are the best idea in the world, especially since all of the restrictions are cleared on exec() if it is permitted IIRC -- so it's useless for sandboxing.
[ Parent | on HN ]
Re:Open-sourcing gVisor, a sandboxed container runtime by brynet on Friday May 04, 2018 @12:21PM (#16995778)
Of course. If you promise "exec", then you're allowed exec. This allows pledge to be in software that otherwise would be impossible, for example text editors, and other shells. It still reduces attack surface, as the shell itself can no longer open sockets, or random device ioctls. The alternative is no protection at all.

https://man.openbsd.org/pledge

See also execpromises, which addresses your issue.

[ Parent | on HN ]