pledge() and unveil() syscalls:https://www.youtube.com/watch?v=bXO6nelFt-E
Not only are they super useful (the program itself can drop privileges – like, it can initialize itself, read some files, whatever, and then tell the kernel that it will never do anything like that again; if it does, e.g. by being exploited through a bug, it gets killed by the kernel), but they are also extremely easy to use.
Imagine a server program with a connected socket in file descriptor 0. Before reading any data from the client, the program can do this:
unveil("/var/www/whatever", "r");
unveil(NULL, NULL);
pledge("stdio rpath", NULL);
Done. It’s now limited to reading files from that directory, communicating with the existing socket, stuff like that. But it cannot ever read any other files or
exec() into something else.I can’t wait for the day when we have something like this on Linux. There have been some attempts, but it’s not that easy. And it’s certainly not mainstream, yet.
I need to have a closer look at Linux’s Landlock soon (“soon”), but this is considerably more complicated than
pledge()/unveil():https://landlock.io/
Captura de ecrã a um navegador web a tentar visitar parlamento.pt e a falhar com ERR_EMPY_RESPONSE.
gitlab interface in landscape, an "update fork" button exists on the right side
gitlab interface in portrait, no "update fork" button exists
Um maralhal de gente na praça do comércio em Lamego, a ver um qualquer dos espectáculos a decorrer na Feira Medieval de Lamego 2025.
AI Agent learning to play Connect3!
Baby tomatoes starting to get red