Re:OpenBSD's Pledge and Unveil from Python
by trasz on Wednesday September 15, 2021 @07:40AM
(#28537818)
No true, of course you can do that. Not being able to open files or sockets only means you need a small separate process to do that for you and then send you the file descriptors.
Re:OpenBSD's Pledge and Unveil from Python
by toast0 on Wednesday September 15, 2021 @08:11AM
(#28538051)
I said you could get them from a cooperating uncapsicumed process. But, it's not simple, and what are you going to write that loophole process in, and why does it get access to the filesystem if it only needed sockets, etc.
Capsicum is simply not flexible in this way. Maybe if there was a way to open a new socket with a capability you setup earlier, that would be flexible enough.
Re:OpenBSD's Pledge and Unveil from Python
by trasz on Wednesday September 15, 2021 @08:40AM
(#28538323)
It is pretty simple - implementing that for irssi(1) took a dozen or two lines of C, IIRC. Sure, it could be simpler, and hopefully libcasper(3) will make it happen, but it's not much of a difference.
Capsicum may be more flexible in some ways, but it's also less flexible in others.
After you a process entera capsicum mode, it can't open new sockets, except by accepting on an existing listen socket or by receiving them on a unix socket, sent by a cooperating non-capsicum process. This means you can't capsicum a TLS proxy like hitch, which would be a great thing to capsicum since the operation is pretty simple and OpenSSL is scary.