Hacker News Reader

Comment by teamhappy | Hacker News Reader

Here's Theo de Raadt explaining how pledge(2) works: https://www.youtube.com/watch?v=F_7S1eqKsFk

This seems like such an elegant idea it is surprising that it hasn't been done before. I can imagine adding pledge calls to software I write myself. I can't say that for most other policy systems.

Hasn't it? It doesn't look very different from the many syscall filters out there, of which the seccomp family is most used. That's what Chrome and OpenSSH uses to sandbox.

Perhaps the design of pledge will turn out to have advantages, but it's a pity the unix world fragments yet again on something that should be trivial. Either people will limit themselves to chroot as the only portable solution, or hairy libraries will be necessary (like libevent .. no, libev.. wait, libuv).

  > [...] but it's a pity the unix world fragments yet again
  > on something that should be trivial.

FWIW: Theo mentions in the talk that he's willing to change things if that makes it easier for other operating systems to adopt pledge(2).

The simplicity of the interface is what feels novel to me.

It probably isn't an issue with a project like Chrome or Firefox to find someone able to understand all the intricacies of seccomp-bpf and implement it properly. And I am sure seccomp is a much more powerful solution.

But for a sole programmer or small team writing some micro-services or similar it seems unlikely they are going to bother. By comparison sending a string with some well chosen categories looks so ridiculously easy it lowers the barriers a lot.

can anyone provide a textual description of what this is? so far all I've found is a broken manpage and a slideshow presentation without much explanation.

http://man.openbsd.org/OpenBSD-current/man2/pledge.2 and the slides to the presentation http://www.openbsd.org/papers/hackfest2015-pledge/index.html

thanks ... that works. Also this register article is decent: http://www.theregister.co.uk/2015/11/10/untamed_pledge_hopes...

Thank you for the links. Reading the presentation, and ignoring the 'monkey' and 'loudmouth' comments, made me think this could be seen as an implementation of the 'intent security' capability that Android has through its Manifests. Although I assume (I did not go through all the slides) that implementing this is 'slightly' more complex due to the number of things you can pledge to use/non-use.

pledge allows a process to declares privileges it needs to function. If the process accesses something beyond those pledges then the Kernel kills the process. The idea is that this will help reduce the surface area that certain types of attacks like remote code execution can have.

Content starts at around 14:30 minutes if you want to jump over the bashing of others and self-adulation by Theo.

But you miss the wonderfully absurd gif at the ~02:00 mark.

Reply on news.ycombinator.com