Pledge() – a new mitigation mechanism in OpenBSD
1–10 of 119 posts
Re: Pledge() – a new mitigation mechanism in OpenBSD
#2Previous discussion: https://news.ycombinator.com/item?id=10306611
Re: Pledge() – a new mitigation mechanism in OpenBSD
#3I would love to see all the other operating systems adopt pledge(), but as is often the case with OpenBSD's security mitigations, it will be years before we see it happen (if at all).
Re: Pledge() – a new mitigation mechanism in OpenBSD
#4De Raadt sounds like a pleasant, wise human in his slides (let's not talk about the mailing list).
I'm really looking forward to 5.9 if it includes pledge as well as vmm (native hypervisor)
Re: Pledge() – a new mitigation mechanism in OpenBSD
#5For fun I made a perl web app use this. Much simpler than systace or seccomp.
I use the path argument as simple form of chroot(2). Previously I had to create a vnd (think loopback device if you are coming from linux) to chroot nicely. On code updates, some process had to rsync static assets into the chroot (I preload all of the needed perl, then chroot()). On linux, the same app uses containers/namespaces. Leveraging read only bind mounts for static assets, seccomp, and various prctrl fiddling. All that ends up being a few hundred lines of code. With pledge is really just a few lines to call the syscall. Much easier to reason about.
Even if you end up having to allow most syscalls, the path argument alone IMHO makes it worth it.
Re: Pledge() – a new mitigation mechanism in OpenBSD
#6Previous discussion: https://news.ycombinator.com/item?id=10306611
That's a very similar presentation, but this one includes some new details. (Notably that it was renamed from "tame" to "pledge")
Re: Pledge() – a new mitigation mechanism in OpenBSD
#7I would love to see all the other operating systems adopt pledge(), but as is often the case with OpenBSD's security mitigations, it will be years before we see it happen (if at all).
This is kind-of a different case than most mitigations, though. It's right now only possible because OpenBSD takes a whole-system approach to development; how the different syscall groups work can change, and right now only follows "this seems like it aligns with how we usually do things in OpenBSD." But yes, I would like to see a similar mechanism appear in other operating systems.
Re: Pledge() – a new mitigation mechanism in OpenBSD
#8Is this a rename of the tame() function that was posted earlier?
Re: Pledge() – a new mitigation mechanism in OpenBSD
#9Is this a rename of the tame() function that was posted earlier?
Yes.
> formerly known as tame()
http://www.openbsd.org/papers/hackfest2015-pledge/mgp00002.h...
Re: Pledge() – a new mitigation mechanism in OpenBSD
#10Is this a rename of the tame() function that was posted earlier?
Yes. From the second page:
>- formerly known as tame()