Syswall: a firewall for syscalls
polaris64.net
Syswall: a firewall for syscalls
1–10 of 10 posts
Re: Syswall: a firewall for syscalls
#2sounds like https://en.wikipedia.org/wiki/Systrace#Features
more ... http://www.citi.umich.edu/u/provos/systrace/
it didn't work out then, but best wishes to the new generation
Re: Syswall: a firewall for syscalls
#3Sounds a little bit like OpenBSD's pledge - was that a source of inspiration?
Re: Syswall: a firewall for syscalls
#4Sounds a little bit like OpenBSD's pledge - was that a source of inspiration?
Yes, partially, although I wanted to create a more interactive system for end-users to reason about software. I wouldn't recommend it (certainly not yet at least) for system security, tools like seccomp and pledge will do a better job there.
Re: Syswall: a firewall for syscalls
#5sounds like https://en.wikipedia.org/wiki/Systrace#Features more ... http://www.citi.umich.edu/u/provos/systrace/ it didn't work out then, but best wishes to the new generation
You're right; I hadn't come across systrace before actually, but it's very similar to what syswall is trying to achieve. I'll be sure to take a look!
Re: Syswall: a firewall for syscalls
#6sounds like https://en.wikipedia.org/wiki/Systrace#Features more ... http://www.citi.umich.edu/u/provos/systrace/ it didn't work out then, but best wishes to the new generation
What do you mean by it didn't work? Not adopted or are there implementation issues?
Also - for the OP. Don't be discouraged there's so many features to add, management, attribution, machine learning etc
Re: Syswall: a firewall for syscalls
#7sounds like https://en.wikipedia.org/wiki/Systrace#Features more ... http://www.citi.umich.edu/u/provos/systrace/ it didn't work out then, but best wishes to the new generation
What do you mean by it didn't work? Not adopted or are there implementation issues? Also - for the OP. Don't be discouraged there's so many features to add, management, attribution, machine learning etc
There were some security issues in systrace. /http://www.watson.org/~robert/2007woot/
Re: Syswall: a firewall for syscalls
#8How is this different from seccomp?
Re: Syswall: a firewall for syscalls
#9Sounds a little bit like OpenBSD's pledge - was that a source of inspiration?
Yes, partially, although I wanted to create a more interactive system for end-users to reason about software. I wouldn't recommend it (certainly not yet at least) for system security, tools like seccomp and pledge will do a better job there.
Nice work. Just read this :-)
Re: Syswall: a firewall for syscalls
#10How is this different from seccomp?
seccomp is a robust way of restricting a process's syscalls so that it can only do what you allow it to.
syswall is more of an interactive tool (similar to systrace as mentioned in another comment). The goal is not to replace seccomp (it's certainly not meant to provide complete security), but rather to allow users to reason about what a process is actually doing. For example, allowing users to see if a new version does something different from the previous, perhaps meaning that malicious code was added unexpectedly.