Show HN: Porting OpenBSD Pledge() to Linux (justine.lol)

Article summary

The article discusses porting OpenBSD's pledge() to Linux, a feature that allows a process to voluntarily restrict its capabilities. The discussion revolves around the implementation and limitations of this port. The Linux version has some differences from the OpenBSD original, such as not having an option to opt out of inheritance. The implementation is intended to cater to Cosmopolitan Libc's way of doing things.

Main themes

• pledge() port to Linux
• security limitations
• inheritance and opt-out
• system call whitelisting
• sandboxing and code execution
• kernel and system call interface differences
• use cases and applicability

What commenters say

• The pledge() port to Linux has limitations, such as not being able to opt out of inheritance, which may make it less useful for certain use cases.
• The implementation of pledge() on Linux may not be as secure as the OpenBSD version due to differences in the kernel and system call interface.
• The use of a whitelist model for system calls may not be sufficient to ensure security, as new system calls can be added and old ones removed.
• The ability to create new executables after pledging away exec access is a significant bypass that undermines the security of the sandbox.
• The pledge() feature is still useful for preventing certain types of attacks, such as path traversal attacks in web servers.
• The lack of control over the interface between user space and kernel space on Linux makes it harder to implement a secure pledge() feature.
• The use of a broker can help to emulate 'no inheritance' but may not be a viable solution for all use cases.