HardenedBSD Feature Comparison with OpenBSD, FreeBSD, NetBSD

Post by BSDobelix » Mon, Nov 04, 2024, 10:04 AM UTC

ori_b wrote: post #23

ruthmarx wrote: post #21

Earlier quoted context omitted.

> Sandboxing™ Writing it like this is kind of funny, hoenstly, but not for the reasons you probably think. > give you that pledge+unveil doesn't? Not requiring the cooperation of developers to opt-in, for starters. You really think pledge and unveil are equivalent to sandboxing? Can you refer to any sandboxing solution or technologies that limit themselves to restricting syscalls and hiding file paths? Unveil is a lo…

Most programs require a setup phase, where they want a great deal of access to the environment to set up the resources they use, and a steady state phase, where they need very little access beyond pre-opened file descriptors. An externally imposed sandboxing feature can be useful for namespacing, but is necessarily less restrictive than pledge and unveil. For example, in steady state on OpenBSD, most programs can't e…

Post by shiomiru » Mon, Nov 04, 2024, 11:43 AM UTC

ruthmarx wrote: post #42

shiomiru wrote: post #34

Earlier quoted context omitted.

> Can you refer to any sandboxing solution or technologies that limit themselves to restricting syscalls and hiding file paths? FreeBSD has capsicum and Linux has seccomp-bpf & landlock. Of the three, pledge and unveil are the least horrible execution of the same idea (though capsicum is alright, too). Obviously it's not a "run any random machine code on my system safely" type of sandbox, rather it's used by e.g. bro…

> Of the three, pledge and unveil are the least horrible execution of the same idea I don't think they are the same idea though. pledge and unveil are significantly more limited in scope. > Obviously it's not a "run any random machine code on my system safely" type of sandbox That's pretty much what a sandbox is though. Not every limitation or security augmentation is a sandbox, nor does it have to be.

Post by transpute » Mon, Nov 04, 2024, 12:26 PM UTC

ruthmarx wrote: post #50

BSDobelix wrote: post #46

To clarify things a bit, HardenedBSD is a bit like Linux+Grsecurity, but for FreeBSD, yes, there are differences, but overall it's like Grsecurity+. BTW: For Linux, OpenPaX is on the horizon: https://www.phoronix.com/news/Edera-OpenPaX-Announced

OpenPaX looks great, but I can't find a patch anywhere, just an already patched forked kernel tree.

Post by tightbookkeeper » Mon, Nov 04, 2024, 2:41 PM UTC

mrweasel wrote: post #45

tightbookkeeper wrote: post #25

Earlier quoted context omitted.

> Not requiring the cooperation of developers to opt-in, for starters. This is a good point. My initial thought is that the developers would know best what features their application needs? Furthermore, it's work that every user benefits from, rather than requiring an IT professional to reconfigure for each use case. What do you see as the downsides?

> What do you see as the downsides? Legacy software, new security issues which has not yet been patched. As the operator you have no way to isolate the application, you just have to wait for the developer for both mitigation and bug-fixes. In the real world I don't see that making much of a difference. Many sandbox solutions aren't really being used anyway, legacy software can go on it's own VM and network. Micro-seg…

Post by transpute » Mon, Nov 04, 2024, 3:19 PM UTC

saagarjha wrote: post #43

transpute wrote: post #29

Earlier quoted context omitted.

Good LLM prompt seed :)

I doubt it. Most humans do a pretty poor job at this already, and LLMs train on things other humans have written. If you have examples to the contrary for a novel mitigation I'd love to see it, but I will also only believe it when I see it.