Show HN: Porting OpenBSD Pledge() to Linux
> There's been a few devs in the past who've tried this. I'm not going to name names, because most of these projects were never completed.<p>Oh, I'll just name myself (see code link below), I'm not ashamed that this didn't complete.<p>There are more fundamental reasons why these projects don't complete, and they apply to the project linked above as well:<p>- Maintaining lists of allowed syscalls across kernel versions and architectures is unreasonable to do, and it's a moving target. An allowlist-based approach might break when doing a kernel or glibc upgrade, which breaks the API backwards compatibility that the kernel otherwise guarantees.
 - Core parts of glibc are doing initialization work on demand, which complicates matters (should ideally be done before enabling the sandbox, but this is not generally possible)
 - Some pledge() promises can't be mapped correctly; examples:
   - the "dns" promise in cosmopolitan/pledge.c just permits all outgoing UDP connections, which is more than what OpenBSD permits, IIRC
   - the "exec" promise cannot elevate privileges again, as it does in OpenBSD
 - glibc name lookups as they are used for DNS are loading shared libraries on first use (libnss), and it's impossible to tell in advance what these will do unless you control the execution environment
 - The pledge API itself is a moving target as well (compare <a href="https://man.openbsd.org/OpenBSD-6.0/pledge.2" rel="nofollow">https://man.openbsd.org/OpenBSD-6.0/pledge.2</a> and <a href="https://man.openbsd.org/OpenBSD-7.1/pledge.2" rel="nofollow">https://man.openbsd.org/OpenBSD-7.1/pledge.2</a>)
 - In OpenBSD, pledge was always path-aware, until they moved that part into the unveil() call. This is not possible on Linux with seccomp-bpf. (Well, yes yes, with signals that do syscall trampolines and very very tight control over the runtime environment, or with sidecar processes to do the supervision, but both of these require a lot more dedication and can't be just mapped to a call to "pledge()" on Linux.)<p>FWIW, my own (abandoned) implementation is at:
<a href="https://github.com/gnoack/seccomp-scopes/blob/master/pledge.c#L118" rel="nofollow">https://github.com/gnoack/seccomp-scopes/blob/master/pledge....</a><p>IMHO the better approach on Linux is going to be Landlock (<a href="https://landlock.io" rel="nofollow">https://landlock.io</a>) in the future. I'd encourage you to look into it.