Comment by simongr3dal | Hacker News Reader

Comment by simongr3dal | Hacker News Reader

Parent Full thread

AFAIK, with pledge() a process can tell the kernel “I’m only going to use X, Y, Z features” (e.g. read, write from file system)

After the process has told this to the kernel the process can then only do these things for its life time. You can pledge() again later, but you can only restrict your pledge never expand it.

This is a nice feature because it limits the number of processes that can potentially be security liabilities even if they have bugs.

unveil() is a similar feature but for file system paths.

It’s a feature of SerenityOS (inspired/borrowed from OpenBSD), and not a feature of C/C++.

Try reading the article, it’s pretty easy to follow :)

It also offers opportunities for run-time optimizations that a kernel can make around context switching. Seems extremely useful.

If you fork, can you change your pledge?

No a forked process only inherits the broadest permissions of the parent and can only downscope.

It's not the broadest permissions from the parent, but the promises at the time of the fork, for example you can setup the parent in such a way that you fork off early a unprivileged (or privileged) child that has a different set of promises from the parent.

kinda lose the setup / steady state benefit for child processes.

Not at all.

If you can exec, pledges disappear (by default, and also in common practice).

This statement conflicts with other statements here -- is this actually true? It sounds like a security hole.

Why not just pledge not to exec?

if you have exec permission (pledge "exec") you can exec another program and it starts with a clean slate. It's about dropping privileges so it's assumed you know what your doing and in the best case scenario the executed binary will pledge itself.

Pledge is not some external security feature but something that every program itself manages.

Fork and exec are different operations.

There’s a second explicit a am list of pledged capabilities available if/when you exec.

Reply on news.ycombinator.com