News for hackers. Stuff that matters.
Re:Open-sourcing gVisor, a sandboxed container runtime by brynet on Friday May 04, 2018 @12:21PM (#16995778)
Of course. If you promise "exec", then you're allowed exec. This allows pledge to be in software that otherwise would be impossible, for example text editors, and other shells. It still reduces attack surface, as the shell itself can no longer open sockets, or random device ioctls. The alternative is no protection at all.

https://man.openbsd.org/pledge

See also execpromises, which addresses your issue.

There are no comments on this comment yet.