Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pledge() – a new mitigation mechanism in OpenBSD

openbsd.org

Post reply on HN
Print view View original

21–30 of 119 posts

Re: Pledge() – a new mitigation mechanism in OpenBSD

#21

Post by bronson »

biot wrote: post #14

In relation to mitigations, what are the "Loudmouth Linus" and "recent article in Washington Post" references about?

http://www.washingtonpost.com/sf/business/2015/11/05/net-of-...

Linus, in one of his less bright moments, called the OpenBSD team a bunch of masturbating monkeys [1]. Unfortunately, the Linux kernel's conspicuous lack of attack mitigation measures (compared to Win/Mac/OpenBSD/etc) does make one wonder who has been masturbating over the past few years.

[1] http://article.gmane.org/gmane.linux.kernel/706950 (from the article)

(to be clear: I like and use Linux a lot... but Linus's disregard for security is becoming a liability)

Re: Pledge() – a new mitigation mechanism in OpenBSD

#22

Post by kentonv »

biot wrote: post #14

In relation to mitigations, what are the "Loudmouth Linus" and "recent article in Washington Post" references about?

http://www.washingtonpost.com/sf/business/2015/11/05/net-of-...

Article could have been good but is a bit too sensationalist, e.g. pointing out that Ashley Madison runs Linux only to admit that it had nothing to do with their security breach -- OK, so why did you mention it, then?

(In truth, kernel security rarely matters for servers, because the application is usually the first line of defense. I say this as someone who runs one of the rare services where kernel security does matter, so yeah, I wish Linux did more hardening, but the article is misleading.)

Re: Pledge() – a new mitigation mechanism in OpenBSD

#23

Post by tedunangst »

kentonv wrote: post #19

Sounds like this could be implemented on Linux as a library on top of seccomp. I'm not impressed by De Raadt's objection to seccomp. BPF programs may technically be turing-complete, but most of the things pledge() does can be implemented by a pretty simple seccomp filter that's just a flat list of conditionals implementing a whitelist or blacklist. Meanwhile De Raadt points out, correctly, that voluntary security mec…

How does one whitelist open("/dev/null") with seccomp-bpf?

Re: Pledge() – a new mitigation mechanism in OpenBSD

#24

Post by elchief »

biot wrote: post #14

In relation to mitigations, what are the "Loudmouth Linus" and "recent article in Washington Post" references about?

Torvalds called openbsd devs "masturbating monkeys" for their focus on security. Wapo had an article on linux security the othe day.

Re: Pledge() – a new mitigation mechanism in OpenBSD

#25

Post by kentonv »

tedunangst wrote: post #23
kentonv wrote: post #19

Sounds like this could be implemented on Linux as a library on top of seccomp. I'm not impressed by De Raadt's objection to seccomp. BPF programs may technically be turing-complete, but most of the things pledge() does can be implemented by a pretty simple seccomp filter that's just a flat list of conditionals implementing a whitelist or blacklist. Meanwhile De Raadt points out, correctly, that voluntary security mec…

How does one whitelist open("/dev/null") with seccomp-bpf?

I knew someone would ask that.

So, the way I'd recommend doing the filename whitelist is by setting up a mount namespace. Create a tmpfs, create the necessary directory tree inside it, bind-mount each whitelisted path in the tmpfs to the real file, then pivot_root into the tmpfs. This sounds complicated but is actually not very much code, and again a library could make it easier.

But I think you could also do it with pure seccomp. The trick is to copy the filename list into memory pages that you subsequently mark read-only. Then, have your seccomp filter whitelist specifically pointers to those strings, and prohibit making the pages writable again.

(Disclaimer: I just came up with this on a whim, it probably needs more thought.)

Re: Pledge() – a new mitigation mechanism in OpenBSD

#26

Post by [deleted] »

MBCook wrote: post #18
elchief wrote: post #4

De Raadt sounds like a pleasant, wise human in his slides (let's not talk about the mailing list). I'm really looking forward to 5.9 if it includes pledge as well as vmm (native hypervisor)

Really? Tame/pledge seems like a good interface but the dig at Linus seemed unnecessary, the masturbating monkey was totally uncalled for, and the coil of poop juvenile. Seriously lowered my view of the presentation.

[deleted]

Re: Pledge() – a new mitigation mechanism in OpenBSD

#27

Post by [deleted] »

MBCook wrote: post #18
elchief wrote: post #4

De Raadt sounds like a pleasant, wise human in his slides (let's not talk about the mailing list). I'm really looking forward to 5.9 if it includes pledge as well as vmm (native hypervisor)

Really? Tame/pledge seems like a good interface but the dig at Linus seemed unnecessary, the masturbating monkey was totally uncalled for, and the coil of poop juvenile. Seriously lowered my view of the presentation.

[deleted]

Re: Pledge() – a new mitigation mechanism in OpenBSD

#28

Post by detaro »

MBCook wrote: post #18
elchief wrote: post #4

De Raadt sounds like a pleasant, wise human in his slides (let's not talk about the mailing list). I'm really looking forward to 5.9 if it includes pledge as well as vmm (native hypervisor)

Really? Tame/pledge seems like a good interface but the dig at Linus seemed unnecessary, the masturbating monkey was totally uncalled for, and the coil of poop juvenile. Seriously lowered my view of the presentation.

Linus was the one calling the OpenBSD developers "m...... monkeys" (apparently that word triggers the HN spamfilter, I vouched your comment), so I think the OpenBSD guys are allowed to be "a bit miffed".

Re: Pledge() – a new mitigation mechanism in OpenBSD

#29

Post by [deleted] »

MBCook wrote: post #18
elchief wrote: post #4

De Raadt sounds like a pleasant, wise human in his slides (let's not talk about the mailing list). I'm really looking forward to 5.9 if it includes pledge as well as vmm (native hypervisor)

Really? Tame/pledge seems like a good interface but the dig at Linus seemed unnecessary, the masturbating monkey was totally uncalled for, and the coil of poop juvenile. Seriously lowered my view of the presentation.

[deleted]

Re: Pledge() – a new mitigation mechanism in OpenBSD

#30

Post by protomyth »

kentonv wrote: post #19

Sounds like this could be implemented on Linux as a library on top of seccomp. I'm not impressed by De Raadt's objection to seccomp. BPF programs may technically be turing-complete, but most of the things pledge() does can be implemented by a pretty simple seccomp filter that's just a flat list of conditionals implementing a whitelist or blacklist. Meanwhile De Raadt points out, correctly, that voluntary security mec…

Your missing the point of pledge. It's for the developer to protect their code from the outside world. A malicious developer won't let we this and will try to obfuscate their intent and code. This is for the honest developer to mitigate the risk of a programming blunder to become a major exploit. Yes, its voluntary, but the developer has a self interest in using it.
Post reply on HN