Hacker News Reader

Comment by insanitybit | Hacker News Reader

This is great. I'm building something similar, an effects system for rust, and it looks quite a bit like this. The difference is that my effects system compiles to a seccomp + apparmor profile so that your rust program is sandboxed at runtime based on info at compile time.

I have a notion of purity as well :P

I think the applications of this sort of thing are pretty limitless. Maybe rust has `unsafe` but with further verification extensions to the language we can really push confidence in a working, safe product.

View on HN

> compiles to a seccomp + apparmor profile

That’s a really nice demonstrable and practical impact of using effects!

> The difference is that my effects system compiles to a seccomp + apparmor profile so that your rust program is sandboxed at runtime based on info at compile time.

That's awesome! I started working to sandbox my Rust program using seccomp-BPF, and I was quickly frustrated about having to run my program with strace to find out what syscalls I should allow for my program, when it sounded like this information should be available at compile time!

I've wanted to do this for years and I've tried doing it a few times in some weird ways. I'm finally doing it in a hacky but more straightforward way and it's going well.

> my effects system compiles to a seccomp + apparmor profile so that your rust program is sandboxed at runtime based on info at compile time.

is this open or proprietary? I'd love a link to a repo

I'll see if I can open source it this weekend. I'm not trying to be the "like and subscribe for updates" but if you want to see it when it's open source I'd suggest following me on Twitter (or Github? Does Github have a follow thing?) cause I won't remember to reply on HN.

Here's a little snippet:

    #[effect::declare(
      args=(inner_tmp as I)
      returns=("/tmp/" + I)
    )]
    fn tmp_dir(inner_tmp: Path) -> Path {
      Path::from("tmp/").join(inner_tmp)
    }

So it can reason about that Path's constraints. When that Path gets used by, say, "File::create(path)", it gets turned into a rule and added to an apparmor policy.

Apparmor doesn't support a "hey I'm a process, please sandbox me" so I have to write a privileged daemon that manages that bit.

I also have a way to apply effects to functions you don't own, mutating functions, functions that branch, etc. None of that is implemented yet, just designed.

what's your twitter/gh? Could you add them to your hn profile?

Can't be certain, but given the content I'm pretty sure that it's these ones:

- Github : https://github.com/insanitybit

- Twitter: https://twitter.com/InsanityBit

Thanks, yes. I'll add those to my profile.

Nice, followed you on both

Can it compile to systemd service sandboxing directives? Like described here https://www.ctrl.blog/entry/systemd-service-hardening.html

Any public repo yet? This sounds great.

Reply on news.ycombinator.com