Hacker News Reader

Comment by pcwalton | Hacker News Reader

pledge is objectively the wrong model, because it's an ad-hoc set of fixed-function rules. By contrast, Linux seccomp-bpf allows much more flexibility, because you can actually write an arbitrary program to implement whatever sandboxing policy you want.

In fact, your wish list highlights the problems of pledge precisely. You can implement "pretend to succeed" and "dump core for inspection by a trusted supervisor", but only on Linux with seccomp-bpf, not with pledge.

View on HN

It's objectively the right model, because it's simple enough to implement that the vast majority of OpenBSD is pledged, including many ports like Firefox. The vast majority of other systems do not have the equivalent, in spite of having mechanisms that are in theory more powerful than pledge.

Flexible sandboxes don't help if your programs don't run in them.

Maybe it's objectively the right model for right now, and the wrong model for tomorrow, which would make you both right. It's hard to get programmers and packagers to add new OS specific features, at least until most OS's support from variant of that feature, and then they either bite the bullet or they use from library to abstract it.

Pledge is simple, and that helps people adopt it and start using it. When most operating systems are providing something equivalent and most programs are making some use of it, it then becomes a selling point to do it better, because the status quo has moved. At that point, pledge might not compare well, unless it has evolved.

> Maybe it's objectively the right model for right now, and the wrong model for tomorrow.

I'm using my computer right now. And pledge is evolving over time, as we gain experience in what real programs need by implementing protection for them.

Sure, but some things are hard to evolve after a while, and it may be that a clean (or older but more complex) implementation has advantages at some point. I have no idea if pledge will fall under this or not, but it's a common theme in computing.

Firefox is sandboxed via seccomp-bpf on Linux.

Awesome. I just checked, and it appears one FF process is, and one is not: https://bpaste.net/show/d8b3d6ada513

https://wiki.mozilla.org/Security/Sandbox/Seccomp

I would like much more general control, like disable write, or prevent forks, or net access, right from the executing shell. I have selinux experience, and it's too low level.

I think the idea behind pledge was that it's simple enough to be actually used whereas the Linux solution is technically superior but too complicated to be widely used.

I was not referring to the implementation. The first , should be a ;. I agree, bpf looks sweet. It might be so useful that it becomes optional only in spirit.

How many programs are running on your computer right now with seccomp-bpf policies?

Reply on news.ycombinator.com