News for hackers. Stuff that matters.

A comment on Vim/Neovim Arbitrary Code Execution via Modelines. Parent comment

Re:Vim/Neovim Arbitrary Code Execution via Modelines by vesinisa on Tuesday June 04, 2019 @08:01PM (#20100360)
What you describe is called Mandatory Access Control, which is in contrast and supplements standard UNIX Discretionary Access Control (user/file permissions). It is implemented on Linux with AppArmor in addition to SELinux.

I would guess the biggest hurdle in using such systems is the complexity and expertise required in drafting the specific rules that should apply in your threat model.

[ Parent | on HN ]
Re:Vim/Neovim Arbitrary Code Execution via Modelines by ibotty on Wednesday June 05, 2019 @02:04AM (#20101872)
If you craft rules for your cmdline tool you will run into problems pretty soon despite the complexity. Better is using a wrapper that is confined. See e.g. SELinux' sandbox(8) which is more or less a "multiwrapper" in that it sets the context explicitly and not implicitly by being confined.
[ Parent | on HN ]