Hacker News Reader

I'd say that's a weird request as pledge/unveil are significantly less secure, even coming close to security theater IMO. Something like AppArmor can protect against a threat without having to rely on the developer to have done the right thing.

Pledge/unveil would not help with the xz issue. AppArmor would.

View on HN

I would say that they are different tools for different purposes. Sure, with pledge/unveil/seccomp you trust the process to do the right thing, it's really about restricting against threats external to the process. But it allows the process to have different privileges at different parts of the program, while external restrictions are not that flexible.

I think it makes sense to use both. Use external restrictions to only give capabilities that the process will ever need, and within the process drop capabilities when they are no longer needed.

> I'd say that's a weird request as pledge/unveil are significantly less secure, even coming close to security theater IMO.

Compared to not using AppArmor, or compared to using AppArmor? The situation I'm concerned about is having an opt-in profile. (NB I don't understand how AppArmor works—linux security profiles are super confusing.)

Reply on news.ycombinator.com