Re:OpenBSD's Pledge and Unveil from Python
by trasz on Wednesday September 15, 2021 @07:40AM
(#28537818)
No true, of course you can do that. Not being able to open files or sockets only means you need a small separate process to do that for you and then send you the file descriptors.
[ Parent
| on HN ]
Re:OpenBSD's Pledge and Unveil from Python
by toast0 on Wednesday September 15, 2021 @08:11AM
(#28538051)
I said you could get them from a cooperating uncapsicumed process. But, it's not simple, and what are you going to write that loophole process in, and why does it get access to the filesystem if it only needed sockets, etc.
Capsicum is simply not flexible in this way. Maybe if there was a way to open a new socket with a capability you setup earlier, that would be flexible enough.
Re:OpenBSD's Pledge and Unveil from Python
by trasz on Wednesday September 15, 2021 @08:40AM
(#28538323)
It is pretty simple - implementing that for irssi(1) took a dozen or two lines of C, IIRC. Sure, it could be simpler, and hopefully libcasper(3) will make it happen, but it's not much of a difference.