Hacker News Reader

Comment by anaphor | Hacker News Reader

https://man.openbsd.org/pledge.2 is also pretty damn cool. It effectively lets you make your program use a least authority model of execution, and then you can grant it the capabilities it actually needs to run. I would love to see something similar on Linux (there is capsicum-linux, but it seems like it's abandoned).

View on HN

So like seccomp? Or do you mean a simpler interface like pledge? I haven't really used the seccomp syscall or eBPF directly but I have used libseccomp (https://github.com/seccomp/libseccomp) successfully.

seccomp and eBPF will let you build something like this but it does not do the same thing as pledge.

I'm not saying you're wrong, but at least in terms of the default behaviour of pledge with regard syscalls and configuring seccomp so the kernel kills your whole process when it hits a syscall you haven't whitelisted, it sounds the same, so it would be good to know what the differences are.

I think the difference is just that seccomp/eBPF is lower level and more powerful in terms of what it can do. So pledge gives you a simpler interface to manage things, whereas with eBPF you have much more flexibility (since you're writing in a subset of C) but with that flexibility also comes more complexity. I.e., eBPF is its own scripting language for the kernel, pledge is just a way of managing fine-grained capabilities.

Totally uncool and a dead end. Nobody else will do it that way. "The promises argument is specified as a string, with space separated keywords". caps as strings to be tokenized at runtime are slow, insecure and not validated at compile-time. Never trust a parser in core. This needs to be a bitmask of course. Don't let ruby programmers add OS API's.

The intended ad hominem in the last sentence does very much not apply.

Nah no ad hominem taken! I thought it was funny. I write Ruby, and love it, and wouldn't go near OS API design with a tenth foot pole.

That's about 3cm. Pretty close ;-)

I wouldn't touch it, but watching it up close is quite interesting.

What has it got to do with Ruby ?

Just an example. Could be perl also, but ruby was the fashion then.

> Never trust a parser in core.

So, we have to part ways with our dear printk ?

That would be fantastic, sure. It's a security nightmare. Know about the printf_s extensions? Maintainability?

Reply on news.ycombinator.com