Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pledge and Unveil in OpenBSD [pdf]

openbsd.org

Post reply on HN
Print view View original

11–20 of 36 posts

Re: Pledge and Unveil in OpenBSD [pdf]

#12

Post by lkurusa »

sigjuice wrote: post #8
akavel wrote: post #3

The PDF has no introduction section, seems to be aimed at people who already know what it's talking about. Can anyone shed some light on what is the idea here? I honestly don't understand what's going on, apart from that it seems to be some security-related feature (or actually two of them?)

pledge is seccomp

Not really; seccomp(2) is for _specific_ system calls, pledge(2) is for more broad functionalities.

Re: Pledge and Unveil in OpenBSD [pdf]

#14

Post by brynet »

brynet wrote: post #13

These are the slides from Bob Beck (beck@'s) talk at BSDCan 2018 (Jun 8-9th), apparently missing its first page.. [0] http://www.bsdcan.org/2018/schedule/events/968.en.html Video should eventually show up on YouTube. [0] https://twitter.com/bob_beck/status/1005162340956794880 ;-)

A somewhat related talk from BSDCan was Florian Obser's slaacd(8) - "A privilege separated and sandboxed IPv6 Stateless Address AutoConfiguration Daemon"

https://www.openbsd.org/papers/florian_slaacd_bsdcan2018.pdf

http://www.bsdcan.org/2018/schedule/events/929.en.html

Re: Pledge and Unveil in OpenBSD [pdf]

#16

Post by brynet »

sigjuice wrote: post #8
akavel wrote: post #3

The PDF has no introduction section, seems to be aimed at people who already know what it's talking about. Can anyone shed some light on what is the idea here? I honestly don't understand what's going on, apart from that it seems to be some security-related feature (or actually two of them?)

pledge is seccomp

Not at all, for example you can't implement the ratcheting down semantics of pledge() using seccomp. Say starting with a broader promise set "stdio rpath recvfd", and then dropping to "stdio" after full init.

pledge() can also be found in over 85% of OpenBSD's base system.

Re: Pledge and Unveil in OpenBSD [pdf]

#17

Post by sigjuice »

lkurusa wrote: post #12
sigjuice wrote: post #8

Earlier quoted context omitted.

pledge is seccomp

Not really; seccomp(2) is for _specific_ system calls, pledge(2) is for more broad functionalities.

I didn’t say they are bug-for-bug compatible and 100% interchangeable. Seccomp was not mentioned anywhere in the thread. People who are interested can look up the specific details.

Re: Pledge and Unveil in OpenBSD [pdf]

#18

Post by Panino »

Awesome!

Given the Chrome example starting on page 6, here's my guess as to how pledge and unveil will contain Chrome to e.g. protect SSH keys. First, 3 of the 5 Chrome processes are already pledged to disallow filesystem reads. The two remaining ones (RenderProcess and UtilityProcess) can be unveiled to allow directories like

  * ~/.config/chromium
  * ~/.cache/chromium
  * ~/Downloads
  * /tmp
  * and anything important I don't know of
Additionally, if unveil works like pledge and can be further restricted after e.g. reading files into memory, unveils can then be undone. Anyone know if the following would work to first allow access to /tmp and then revoke that access?

  unveil("/tmp", "rw");
  /* do some work */
  unveil("/tmp", "");

Re: Pledge and Unveil in OpenBSD [pdf]

#19

Post by notaplumber »

Panino wrote: post #18

Awesome! Given the Chrome example starting on page 6, here's my guess as to how pledge and unveil will contain Chrome to e.g. protect SSH keys. First, 3 of the 5 Chrome processes are already pledged to disallow filesystem reads. The two remaining ones (RenderProcess and UtilityProcess) can be unveiled to allow directories like * ~/.config/chromium * ~/.cache/chromium * ~/Downloads * /tmp * and anything important I do…

Indeed! The full unveil semantics aren't known yet, may be worth proposing! But for the specific case of /tmp, there is already a tmppath promise.

Re: Pledge and Unveil in OpenBSD [pdf]

#20

Post by agumonkey »

brynet wrote: post #16
sigjuice wrote: post #8

Earlier quoted context omitted.

pledge is seccomp

Not at all, for example you can't implement the ratcheting down semantics of pledge() using seccomp. Say starting with a broader promise set "stdio rpath recvfd", and then dropping to "stdio" after full init. pledge() can also be found in over 85% of OpenBSD's base system.

brings me to the next question: are there linux equivalent ?
Post reply on HN