Re:OpenBSD's Pledge and Unveil from Python
by ghoward on Wednesday September 15, 2021 @01:23AM
(#28535538)
I upvoted, but I wanted to correct a small thing.
> ...they are mostly hopeless to try to apply to portable software after the fact if the devs aren't constantly testing with it.
They don't have to be hopeless. They were pretty easy ([1], [2]) to add to my bc.
[1]: https://git.yzena.com/gavin/bc/commit/3e8cd345de9d5b65ac7c33...
[2]: https://git.yzena.com/gavin/bc/commit/b6c65bb44c910c054bedfa...
Re:OpenBSD's Pledge and Unveil from Python
by dbt00 on Wednesday September 15, 2021 @01:29AM
(#28535572)
Yes. That's awesome!
I was referring to the OpenBSD devs trying to hack pledges into other people's software by trying to guess what capabilities it needs while porting. That's not a good thing to try to do -- see also all the various attempts at guessing seccomp profiles in the Linux world, which has the same problem.
Re:OpenBSD's Pledge and Unveil from Python
by ben_bai on Wednesday September 15, 2021 @07:46AM
(#28537867)
Has been done to some 3rd party applications. Notably Chromium is pledged an unveiled, Firefox (unveil), pdf readers, compression tools, mail clients, ...
grep the ports tree for pledge patches.
(There are other mechanisms like containers or freebsd' jail that try to accomplish the same thing, but those tend to be "lots of functionality inside the sandbox" solutions, whereas openbsd is mostly aiming for "allow nothing besides the minimum in the sandbox".
(edited for clarity, thanks for the nudge ghoward).