dan sounds super confident and experienced (his profile seems to indicate so as well) but I am pretty sure he is not correct.
0 Boosts
0 Likes
@sun the top response seems to have been written by someone (Doc) who thinks that uid 0 == root == all access to everything which is not true. there are many ways to have a uid 0 / root user that can't do fuck all. their understanding of what is possible in a unix-like system is literally stuck in the 70s.
@feld you're correct but he's also correct that generally the mitigation for uid0 total control is MAC, which, as he mentioned, is a ton of code to do that, which is an increase in attack surface. the other mitigation is dropping privileges which isn't as bad I admit.
@sun @feld A good first step would be making seccomp-bpf usable without losing one's hair. So far only OpenBSD did syscall filtering in a sane although a partially limiting way. Capsicum failed and seccomp is hard to implement to the point of developers giving up on it. And landlock is even less used despite being way better. Linux has 4 LSMs (AppArmor, SELinux, seccomp and landlock) all competing for similar field at this point.
@phnt @sun
> So far only OpenBSD did syscall filtering in a sane although a partially limiting way. Capsicum failed and seccomp is hard to implement to the point of developers giving up on it.
these are all vastly different approaches though, and Capsicum didn't fail; its usage is still being expanded in FreeBSD.
> So far only OpenBSD did syscall filtering in a sane although a partially limiting way. Capsicum failed and seccomp is hard to implement to the point of developers giving up on it.
these are all vastly different approaches though, and Capsicum didn't fail; its usage is still being expanded in FreeBSD.
@phnt @sun
> I cannot name a single project outside FreeBSD that implemented Capsicum.
well, it was implemented for Chromium but they never accepted it upstream. I think there's another better example but I'm drawing a blank right now.
https://github.com/rwatson/chromium-capsicum
> I cannot name a single project outside FreeBSD that implemented Capsicum.
well, it was implemented for Chromium but they never accepted it upstream. I think there's another better example but I'm drawing a blank right now.
https://github.com/rwatson/chromium-capsicum
@phnt @sun Google ported Capsicum to Linux but it never got accepted upstream either
https://github.com/google/capsicum-linux
CloudABI copied the Capsicum model an had implementations for FreeBSD, NetBSD, and Linux, then shutdown the project in 2020
so yeah. Sadface.gif
https://github.com/google/capsicum-linux
CloudABI copied the Capsicum model an had implementations for FreeBSD, NetBSD, and Linux, then shutdown the project in 2020
so yeah. Sadface.gif
@feld if you drop privs it's not really root anymore right, I am not sure where that leaves anybody in the debate. it's true it's more complex than just god-mode account which is in your favor. but also again, it's a bolt-on to the model.
@feld there are two things he says and one is much more defensible than the other. the first is he says stuff about linux/unix that is out of date. but it is true that it's insanely harder to prove a posix system safe because of its fundamental design. this is exactly why it's been troublesome for some C programmers in the Linux kernel when they bolted on Rust code, because Rust code requires discipline and boundaries to interact with the C code that the Linux system couldn't initially provide.
@sun hes right though, linux is too fat. Issa fat fuck. Smaller operating system - better