From OpenBSD to Linux: How Pledge can Enhance Linux Security

Byadmin

Warp Terminal
Run this command to make it executable.Curl is a tool that deals with URLs and indeed requires those system calls.Utilizing Libc Cosmopolitan, she was able to port OpenBSD Pledge to the Linux system. Here’s the nice blog done by her.

These binary files are called Actually Portable Executable (APE). You can check out this blog for more information. These binary files have the .com suffix and it’s necessary to work.Let’s assign promises using the -p flag. I’ll explain what each of these promises does in the next section.

What makes this port possible?

Won’t it be great if you’ve the tool to run and test the application within the defined security parameter. Like, we all know, ls command list the files in the current working directory. So, why would it require a network connection to operate? Does it make sense?📋You can download pledge-1.8.com from the url- http://justine.lol/pledge/pledge-1.8.com.

With this information, you can see if a program is requesting a system call that it should not. For example, a file explorer program asking for dns. Is it normal? With this information, you can see if a program is requesting a system call that it should not. For example, a file explorer program asking for dns. Is it normal?
The debug message error:pledge inet for socket is mis-leading. Even a similar open issue exists at the project’s GitHub repo. It is evident that after providing these sets of promises “stdio rpath inet dns tty sendfd recvfd” to our curl binary, it works as expected.

OpenBSD’s pledge follows the Least Privilege model. It prevents programs from mis-utilizing system resources. Following this security model, the damage done by a malicious application can be quite limited. Although Linux has seccomp and apparmor in its security arsenal, I find pledge more intuitive and easy to use.Cosmopolitan makes it a bridge for compiling a c programs for 7 different platforms (Linux + Mac + Windows + FreeBSD + OpenBSD 7.3 + NetBSD + BIOS) at one go.

A quick glance at promises

pledge.com -p 'stdio rpath inet dns tty sendfd recvfd'
curl -s http://itsfoss.com

That’s where the tool, Pledge, comes in. Pledge restricts the system calls a program can make. Pledge is natively supported on OpenBSD systems. Although it isn’t officially supported on Linux systems, I’ll show you a cool hack to utilize pledge on your Linux systems.
Porting OpenBSD pledge() to LinuxSandboxing for Linux has never been easier.

Conclusion

🚧pledge.com -p 'stdio rpath inet dns tty sendfd recvfd'
curl -s https://itsfoss.com

Read moreNSX-T Tier-1 Service Router (SR) Placement

To know what other promises are supported by the pledge binary, head over to this blog.

Similar Posts