[{"data":1,"prerenderedAt":568},["ShallowReactive",2],{"project-32096801":3},{"id":4,"name":5,"line":6,"line_source":7,"title":8,"url":9,"domain":10,"maker":11,"posted_at":12,"year":13,"points":14,"comments":15,"rank_in_year":16,"shown_in_year":17,"top":18,"tier":19,"category":20,"subcategory":21,"format":22,"keywords":23,"reception":29,"sentiment":30,"stance_mix":31,"scored_comments":36,"aspects":37,"strip":48,"post_text":51,"what":52,"said":99,"maker_in_thread":175,"shape":183,"grid":187,"attempts":531,"same_week":532,"maker_shows":328,"maker_hidden":561,"reader_version":562,"card":563},"32096801","pledge.com","Porting OpenBSD Pledge() to Linux","title","Show HN: Porting OpenBSD Pledge() to Linux","https:\u002F\u002Fjustine.lol\u002Fpledge\u002F","justine.lol","jart",1657810362,2022,571,128,39,2570,2,"legend","dev_tools","sandboxing utility","cli",[24,25,26,27,28],"pledge","seccomp","sandboxing","linux","openbsd","mixed",-0.01,{"positive":32,"neutral":33,"mixed":34,"critical":35},15,24,0,23,62,{"performance":38,"idea":39,"execution":42,"design":45,"docs":47},{"positive":34,"critical":34},{"positive":40,"critical":41},7,11,{"positive":43,"critical":44},1,9,{"positive":34,"critical":46},3,{"positive":34,"critical":34},[49,46,34,34,50,43,46,43,18,50,43,43,43,46,43,43,46,49,46,46,43,43,46,34,43,49,43,49,18,43,43,49,46,46,18,46,43,46,46,49],5,4,null,{"problem":53,"audience":51,"pricing":51,"motivation":65,"time_to_build":51,"stack":75,"openness":97,"stage":98,"team_size":98},{"value":54,"source":55,"evidence":56},"Restricting a program's system calls on Linux the way OpenBSD pledge() does.","inferred",[57,61],{"id":58,"by":59,"text":60},"32097538","jamal-kumar","Thanks Justine, you're doing the Lord's work here. One of the best introductions I've seen to pledge() is Kristaps Dzonson's writeup on it that you can find here [1]. The whole…",{"id":62,"by":63,"text":64},"32098782","crtxcr","Great work! >.. So how do we get it that simple on Linux? I believe the answer is to find someone with enough free time to figure out how to use SECCOMP BPF to implement pledge.…",{"value":66,"source":67,"evidence":68},"Bring OpenBSD's pledge() model to Linux without needing root.","maker",[69,72],{"id":70,"by":11,"text":71},"32108484","Yes but we can't always assume a broker is installed. For instance I distribute a lot of foss software. I don't want to have to ask my users to install and adopt these other…",{"id":73,"by":11,"text":74},"32146832","> Firejail I'm sure it's great but it requires setuid privileges. If it needs root it isn't ad-hoc. > But I agree that software developers know their software the best so they…",[76,83,90],{"value":77,"source":67,"evidence":78},"C",[79,80],{"id":58,"by":59,"text":60},{"id":81,"by":11,"text":82},"32100624","Awesome blog post! Writing web apps in C? That doesn't sound crazy to me. If someone told me they were doing that, then I'd just assume they're trying to compete with Google…",{"value":84,"source":67,"evidence":85},"Cosmopolitan Libc",[86,89],{"id":87,"by":11,"text":88},"32101233","> Of course the problem is that it needs some cooperation between libc and the kernel. You may have missed that our new pledge() impl is hosted in the Cosmopolitan Libc…",{"id":81,"by":11,"text":82},{"value":91,"source":67,"evidence":92},"seccomp BPF",[93,94],{"id":62,"by":63,"text":64},{"id":95,"by":11,"text":96},"32097919","sendfd is something we can add. Note that seccomp has limited visibility into recvmsg \u002F sendmsg args because bpf can't dereference syscall arg pointers. I mention some of this in…","open_source","unknown",{"praise":100,"objections":110,"requests":134,"questions":149,"alternatives":161},[101],{"value":102,"source":103,"evidence":104},"Good introduction to pledge; valuable for constrained environments.","commenter",[105,106],{"id":58,"by":59,"text":60},{"id":107,"by":108,"text":109},"32101737","bowsamic","I was introduced to pledge via SerenityOS and it really is amazing",[111,122,126],{"value":112,"source":103,"evidence":113},"Syscall lists are hard to maintain across kernel versions and architectures.",[114,118],{"id":115,"by":116,"text":117},"32097649","knorker","Having tried this myself i don't believe in this implementation. The list of syscalls is not only dynamic across kernel versions, but even different between architectures. You…",{"id":119,"by":120,"text":121},"32097714","gnoack","> There's been a few devs in the past who've tried this. I'm not going to name names, because most of these projects were never completed. Oh, I'll just name myself (see code…",{"value":123,"source":103,"evidence":124},"Path-aware restrictions are not possible with seccomp BPF.",[125],{"id":119,"by":120,"text":121},{"value":127,"source":103,"evidence":128},"AppArmor or Landlock would be better approaches.",[129,133],{"id":130,"by":131,"text":132},"32128719","neop1x","I can see it is a very simple and easy way to restrict stuff but it is also very basic (allow or deny file write ops anywhere). There is AppArmor which is much more flexible and…",{"id":119,"by":120,"text":121},[135,142],{"value":136,"source":103,"evidence":137},"Add sendfd promise and document extensions.",[138],{"id":139,"by":140,"text":141},"32097723","notaplumber1","Hi jart, I noticed that you're missing the sendfd promise. Is there a reason for that omission? Also you've added a number of extensions that perhaps should be documented as…",{"value":143,"source":103,"evidence":144},"Support glibc users.",[145,146],{"id":87,"by":11,"text":88},{"id":147,"by":11,"text":148},"32100077","It works fine for me if Curl is built with Musl Libc. I can see you're using a very cutting edge glibc. I tried reproducing this on Debian 10. The only calls that got EPERM'd…",[150,154],{"value":151,"source":103,"evidence":152},"Why are promises inherited across exec, unlike OpenBSD?",[153],{"id":139,"by":140,"text":141},{"value":155,"source":103,"evidence":156},"Can MAP_POPULATE be used?",[157],{"id":158,"by":159,"text":160},"32100091","levodelellis","This is great If you like I can run pledge against my more complicated app to see if it complains. I did it on a simple app and it seemed to not like how I used memory map…",[162,167,171],{"value":163,"source":103,"evidence":164},"Landlock",[165,166],{"id":119,"by":120,"text":121},{"id":62,"by":63,"text":64},{"value":168,"source":103,"evidence":169},"AppArmor",[170],{"id":130,"by":131,"text":132},{"value":172,"source":103,"evidence":173},"Firejail",[174],{"id":73,"by":11,"text":74},{"comments":176,"answered":50,"key":177},18,[178,179,182],{"id":81,"text":82},{"id":180,"text":181},"32105652","Thanks for explaining. Please note I don't work for Google. I did four years ago.",{"id":87,"text":88},{"commenters":184,"max_depth":44,"maker_replies":176,"first_comment_mins":185,"lifespan_hours":186},63,14,267,[188,190,191,193,197,200,203,205,207,208,210,212,215,219,222,225,227,230,234,237,240,242,243,245,247,249,251,255,258,261,264,267,268,271,275,276,279,282,285,288,290,294,296,298,300,302,303,305,307,309,311,313,315,317,320,323,326,331,334,338,339,341,343,346,348,351,353,356,359,361,363,365,368,372,375,377,380,382,385,388,391,392,395,398,401,402,405,409,411,415,418,421,424,426,429,431,432,436,438,442,445,448,450,452,456,460,464,468,470,474,478,483,486,488,492,494,497,500,504,506,508,511,515,517,519,522,524,528],[58,34,49,189,59,34],"maker\u002Fpositive\u002Fnone",[81,34,34,189,11,43],[192,34,49,189,59,34],"32102079",[194,34,46,195,196,34],"32104484","project\u002Fneutral\u002Fperformance","staticassertion",[198,34,34,199,59,34],"32104607","other\u002Fneutral\u002Fnone",[201,34,34,199,202,34],"32105489","saagarjha",[204,34,34,199,59,34],"32107293",[206,34,34,199,202,34],"32116420",[180,34,34,199,11,43],[209,34,34,199,59,34],"32110738",[211,34,34,199,202,34],"32105459",[213,34,34,199,214,34],"32101471","dang",[216,43,49,217,218,34],"32100660","project\u002Fpositive\u002Fidea","holsta",[220,43,49,217,221,34],"32100685","dbtc",[223,43,43,224,116,34],"32101077","project\u002Fcritical\u002Fexecution",[87,43,34,226,11,43],"project\u002Fneutral\u002Fexecution",[228,43,34,229,116,34],"32105256","commenter\u002Fcritical\u002Fexecution",[231,43,34,232,233,34],"32106242","other\u002Fneutral\u002Fidea","tux2bsd",[235,43,43,236,116,34],"32107350","project\u002Fcritical\u002Fidea",[238,43,34,239,233,34],"32112952","commenter\u002Fneutral\u002Fnone",[241,43,34,199,116,34],"32149781",[139,18,46,226,140,34],[95,18,34,244,11,43],"project\u002Fpositive\u002Fexecution",[246,18,43,224,140,34],"32099283",[248,18,34,217,11,43],"32100775",[250,18,43,236,140,34],"32100936",[252,18,46,253,254,34],"32103581","project\u002Fneutral\u002Fidea","gnubison",[256,18,46,253,257,34],"32100699","tych0",[259,18,34,199,260,34],"32228042","l0kod",[262,18,46,226,263,34],"32101267","archivator",[265,18,49,189,266,34],"32101608","octernion",[62,46,46,253,63,34],[269,46,43,224,270,34],"32101139","thomashabets2",[272,46,34,273,274,34],"32102483","commenter\u002Fpositive\u002Fnone","V-eHGsd_",[119,50,43,236,120,34],[277,50,43,236,278,34],"32097771","the8472",[280,50,34,281,196,34],"32098577","commenter\u002Fneutral\u002Fidea",[283,50,34,281,284,34],"32102305","mzs",[286,50,34,287,196,34],"32102505","commenter\u002Fcritical\u002Fidea",[289,50,43,224,196,34],"32103832",[291,50,34,292,293,34],"32105442","commenter\u002Fneutral\u002Fexecution","mst",[295,50,34,239,196,34],"32108363",[297,50,46,253,278,34],"32106205",[299,50,34,217,11,43],"32106394",[301,50,46,253,196,34],"32108354",[70,50,34,217,11,43],[304,50,43,224,196,34],"32110296",[306,50,34,226,11,43],"32116309",[308,50,43,224,196,34],"32126074",[310,50,34,239,278,34],"32117073",[312,50,34,239,196,34],"32126082",[314,50,43,236,120,34],"32097872",[316,50,49,217,196,34],"32098564",[318,50,46,253,319,34],"32100678","wahern",[321,50,34,199,322,34],"32100512","_wldu",[324,49,49,217,325,34],"32098842","ingenieroariel",[327,328,49,329,330,34],"32097387",6,"project\u002Fpositive\u002Fnone","roryrjb",[332,40,34,199,333,34],"32099005","gbrown_",[335,336,34,199,337,34],"32096962",8,"grimgrin",[158,44,46,226,159,34],[340,44,34,226,11,43],"32100284",[342,44,49,244,159,34],"32100763",[344,44,34,345,11,43],"32100877","maker\u002Fneutral\u002Fnone",[115,347,43,224,116,34],10,[349,347,34,350,11,43],"32098246","project\u002Fneutral\u002Fnone",[352,347,43,236,116,34],"32101017",[354,347,34,355,11,43],"32101493","project\u002Fneutral\u002Fdesign",[357,347,43,358,202,34],"32105513","project\u002Fcritical\u002Fdesign",[360,347,34,239,202,34],"32105509",[362,347,34,239,116,34],"32105670",[364,347,34,239,202,34],"32110137",[366,41,46,253,367,34],"32100054","djhworld",[369,370,34,199,371,34],"32098293",12,"asveikau",[373,370,34,199,374,34],"32099273","efortis",[376,370,34,199,371,34],"32099475",[378,370,34,199,379,34],"32099324","volkadav",[381,370,34,199,371,34],"32101460",[383,370,34,199,384,34],"32099378","octetta",[386,370,34,199,387,34],"32099998","shp0ngle",[389,390,43,224,278,34],"32097680",13,[107,185,49,217,108,34],[393,185,46,350,394,34],"32102367","sph",[396,185,34,397,108,34],"32105077","other\u002Fpositive\u002Fnone",[399,32,43,224,400,34],"32099507","jacobmischka",[147,32,34,226,11,43],[403,32,46,226,404,34],"32100415","fweimer",[406,407,49,189,408,34],"32099255",16,"rank0",[410,407,34,189,11,43],"32110031",[412,413,49,189,414,34],"32098605",17,"MrWiffles",[416,176,46,253,417,34],"32099422","fullstop",[419,176,46,226,420,34],"32100497","btdmaster",[422,423,43,236,270,34],"32101162",19,[130,425,43,236,131,34],20,[427,425,34,428,11,43],"32134520","commenter\u002Fcritical\u002Fnone",[430,425,34,239,131,34],"32141204",[73,425,34,239,11,43],[433,434,43,358,435,34],"32107939",21,"account42",[437,434,34,355,11,43],"32108303",[439,440,34,199,441,34],"32100918",22,"post-factum",[443,35,49,217,444,34],"32098661","gigatexal",[446,35,34,199,447,34],"32099549","smm11",[449,35,34,199,444,34],"32101827",[451,33,49,189,293,34],"32104822",[453,454,43,236,455,34],"32107250",25,"forty",[457,458,46,253,459,34],"32106230",26,"lapser",[461,462,46,253,463,34],"32104521",27,"Cloudef",[465,466,46,355,467,34],"32097290",28,"liuliu",[469,466,34,226,11,43],"32098087",[471,472,34,199,473,34],"32101333",29,"turndown",[475,476,43,236,477,34],"32098945",30,"oynqr",[479,480,46,481,482,34],"32101941",31,"project\u002Fneutral\u002Fdocs","j-bos",[484,480,46,481,485,34],"32102268","frays",[487,480,34,273,482,34],"32103964",[489,490,46,253,491,34],"32099054",32,"waynesonfire",[493,490,34,199,284,34],"32102413",[495,490,43,236,496,34],"32105548","trasz",[498,490,34,199,499,34],"32113005","gnufx",[501,502,43,358,503,34],"32104930",33,"rurban",[505,502,34,199,202,34],"32105553",[507,502,46,355,140,34],"32107062",[509,502,34,510,503,34],"32121727","commenter\u002Fneutral\u002Fdesign",[512,513,46,253,514,34],"32099898",34,"mike_hock",[516,513,46,253,270,34],"32101168",[518,513,34,239,514,34],"32105140",[520,513,34,521,270,34],"32105650","commenter\u002Fcritical\u002Fprivacy",[523,513,34,239,514,34],"32105763",[525,526,34,199,527,34],"32102427",35,"badrabbit",[529,526,49,217,530,34],"32103687","jrockway",[],[533,538,542,547,552,556],{"id":534,"name":535,"points":536,"category":537},"32095592","Unblah",451,"productivity",{"id":539,"name":540,"points":541,"category":20},"32106126","tere",378,{"id":543,"name":544,"points":545,"category":546},"32149989","Flowful",299,"creative",{"id":548,"name":549,"points":550,"category":551},"32167704","This Food Does Not Exist",248,"ai",{"id":553,"name":554,"points":555,"category":537},"32152600","algorithm",214,{"id":557,"name":558,"points":559,"category":560},"32121846","A compiler and VM for a simple language, in 150 lines of code",200,"languages",false,"v2",{"id":564,"name":5,"line":6,"ai":561,"cat":20,"year":13,"points":14,"comments":15,"rec":29,"s":30,"top":18,"kw":565,"maker":11,"domain":10,"tier":19,"attempts":34,"strip":566,"url":9,"mix":567,"praise":102,"objection":112,"sub":21},32096801,[24,25,26,27,28],"5300413124111311353311301515211533231335",[32,33,34,35],1794036622543]