pledge.com
Dev tools
sandboxing utility
SHOW HN2022
How HN took it
15 positive, 24 neutral or asking, 0 mixed, 23 critical, out of 62 comments about the project. Thread score -0.01.
Idea: 7 for, 11 againstExecution: 1 for, 9 againstDesign: 0 for, 3 against
The thread, comment by comment
Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.
positive neutral or mixed critical about another commenter or something else the maker
What HN said
What people liked
Good introduction to pledge; valuable for constrained environments.
From 2 comments
Thanks Justine, you're doing the Lord's work here. One of the best introductions I've seen to pledge() is Kristaps Dzonson's writeup on it that you can find here [1]. The whole…
jamal-kumar on HNI was introduced to pledge via SerenityOS and it really is amazing
bowsamic on HN
Objections
Syscall lists are hard to maintain across kernel versions and architectures.
From 2 comments
Having tried this myself i don't believe in this implementation. The list of syscalls is not only dynamic across kernel versions, but even different between architectures. You…
knorker on HN> There's been a few devs in the past who've tried this. I'm not going to name names, because most of these projects were never completed. Oh, I'll just name myself (see code…
gnoack on HN
Path-aware restrictions are not possible with seccomp BPF.
From 1 comment
> There's been a few devs in the past who've tried this. I'm not going to name names, because most of these projects were never completed. Oh, I'll just name myself (see code…
gnoack on HN
AppArmor or Landlock would be better approaches.
From 2 comments
I can see it is a very simple and easy way to restrict stuff but it is also very basic (allow or deny file write ops anywhere). There is AppArmor which is much more flexible and…
neop1x on HN> There's been a few devs in the past who've tried this. I'm not going to name names, because most of these projects were never completed. Oh, I'll just name myself (see code…
gnoack on HN
Requests
Add sendfd promise and document extensions.
From 1 comment
Hi jart, I noticed that you're missing the sendfd promise. Is there a reason for that omission? Also you've added a number of extensions that perhaps should be documented as…
notaplumber1 on HN
Support glibc users.
From 2 comments
> Of course the problem is that it needs some cooperation between libc and the kernel. You may have missed that our new pledge() impl is hosted in the Cosmopolitan Libc…
jart on HNIt works fine for me if Curl is built with Musl Libc. I can see you're using a very cutting edge glibc. I tried reproducing this on Debian 10. The only calls that got EPERM'd…
jart on HN
Questions
Why are promises inherited across exec, unlike OpenBSD?
From 1 comment
Hi jart, I noticed that you're missing the sendfd promise. Is there a reason for that omission? Also you've added a number of extensions that perhaps should be documented as…
notaplumber1 on HN
Can MAP_POPULATE be used?
From 1 comment
This is great If you like I can run pledge against my more complicated app to see if it complains. I did it on a simple app and it seemed to not like how I used memory map…
levodelellis on HN
Alternatives named
Landlock
From 2 comments
> There's been a few devs in the past who've tried this. I'm not going to name names, because most of these projects were never completed. Oh, I'll just name myself (see code…
gnoack on HNGreat work! >.. So how do we get it that simple on Linux? I believe the answer is to find someone with enough free time to figure out how to use SECCOMP BPF to implement pledge.…
crtxcr on HN
AppArmor
From 1 comment
I can see it is a very simple and easy way to restrict stuff but it is also very basic (allow or deny file write ops anywhere). There is AppArmor which is much more flexible and…
neop1x on HN
Firejail
From 1 comment
> Firejail I'm sure it's great but it requires setuid privileges. If it needs root it isn't ad-hoc. > But I agree that software developers know their software the best so they…
jart on HN