Hacker News Reader

Comment by darby_eight | Hacker News Reader

Is there any indication Linux is going to adopt a pledge/unveil api in the near future? It's hard to place faith in systems like app armor that rely on system administrators to implement security guarantees.

View on HN

I'd say that's a weird request as pledge/unveil are significantly less secure, even coming close to security theater IMO. Something like AppArmor can protect against a threat without having to rely on the developer to have done the right thing.

Pledge/unveil would not help with the xz issue. AppArmor would.

I would say that they are different tools for different purposes. Sure, with pledge/unveil/seccomp you trust the process to do the right thing, it's really about restricting against threats external to the process. But it allows the process to have different privileges at different parts of the program, while external restrictions are not that flexible.

I think it makes sense to use both. Use external restrictions to only give capabilities that the process will ever need, and within the process drop capabilities when they are no longer needed.

> I'd say that's a weird request as pledge/unveil are significantly less secure, even coming close to security theater IMO.

Compared to not using AppArmor, or compared to using AppArmor? The situation I'm concerned about is having an opt-in profile. (NB I don't understand how AppArmor works—linux security profiles are super confusing.)

Linux has seccomp and landlock, which are basically harder-to-use versions of pledge/unveil.

Someone has combined those things to port Pledge to Linux.

https://github.com/jart/pledge

Reply on news.ycombinator.com