6 ms·
OS X's libsandbox is much closer to SELinux. It's MAC-based (mandatory access control not Macintosh) and is actually TrustedBSD under the covers. Pledge simply
by sdkmvx 10y ago
OS X's libsandbox is much closer to SELinux. It's MAC-based (mandatory access control not Macintosh) and is actually TrustedBSD under the covers. Pledge simply disallows access to syscalls and paths outside a list. It's not very fine-grained. It also resets on exec, so it can't be used as a sandbox or container.
- brynet 10y agoThe entire point of pledge is self-sandboxing, in the case of an exec promise the expectation is the new process will also self-sandbox. If you think of a shell as an example, it will need to exec programs that do privileged things before they can drop them, but the parent shell itself may never need to say.. create sockets.
- icebraining 10y agoUnless it's Bash, with its /dev/tcp interface.