Pledge and Unveil in OpenBSD [pdf]

Post by teamhappy » Sun, Jun 10, 2018, 9:30 AM UTC

Post by beefhash » Sun, Jun 10, 2018, 10:44 AM UTC

akavel wrote: post #3

The PDF has no introduction section, seems to be aimed at people who already know what it's talking about. Can anyone shed some light on what is the idea here? I honestly don't understand what's going on, apart from that it seems to be some security-related feature (or actually two of them?)

    /* Only the system calls required
     * for the standard I/O library and
     * for accessing /dev/tty are allowed
     * by the kernel from this point on.
     */
    pledge("stdio tty", NULL);

Post by nbe » Sun, Jun 10, 2018, 12:58 PM UTC

Fnoord wrote: post #5

beefhash wrote: post #4

Earlier quoted context omitted.

pledge(2) on OpenBSD is used to drop the privileges of a process. Processes are meant to call pledge(2) to drop their own privileges. The way pledge(2) works is that the system calls of that process get limited. If a process calls a system call outside the allowed range after calling pledge(2), it gets killed. Starting with OpenBSD 6.3, it is also possible to configure pledge to make the kernel return ENOSYS instead…

Wasn't there some kind of equiv in OpenBSD long ago, by Niels Provos? Or was it the Stephanie patch? [1] At the bottom they mention Qmail which was immediately my first thought as an example as well, since it breaks up MTA tasks to different daemons. [1] http://packetfactory.openwall.net/projects/stephanie/index.h...

Post by sigjuice » Sun, Jun 10, 2018, 1:54 PM UTC

akavel wrote: post #3

The PDF has no introduction section, seems to be aimed at people who already know what it's talking about. Can anyone shed some light on what is the idea here? I honestly don't understand what's going on, apart from that it seems to be some security-related feature (or actually two of them?)

Post by nbe » Sun, Jun 10, 2018, 2:27 PM UTC

Fnoord wrote: post #7

nbe wrote: post #6

Earlier quoted context omitted.

I think you're refering to systrace. It was removed in OpenBSD 6.0. http://www.citi.umich.edu/u/provos/systrace/

Thanks, that's exactly what I meant. Why was it removed? I did notice pledge(2) first appeared in 5.9 [1] How do other Unices such as Linux deal with this issue (IIRC systrace was ported to other Unices)? Is Pledge ported to other BSDs? [1] http://man.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man2/...