From OpenBSD to Linux: How Pledge can Enhance Linux Security

Run this command to make it executable.Curl is a tool that deals with URLs and indeed requires those system calls.Utilizing Libc Cosmopolitan, she was able to port OpenBSD Pledge to the Linux system. Here’s the nice blog done by her.

What makes this port possible?

Won’t it be great if you’ve the tool to run and test the application within the defined security parameter. Like, we all know, ls command list the files in the current working directory. So, why would it require a network connection to operate? Does it make sense?📋You can download pledge-1.8.com from the url- http://justine.lol/pledge/pledge-1.8.com.

OpenBSD’s pledge follows the Least Privilege model. It prevents programs from mis-utilizing system resources. Following this security model, the damage done by a malicious application can be quite limited. Although Linux has seccomp and apparmor in its security arsenal, I find pledge more intuitive and easy to use.Cosmopolitan makes it a bridge for compiling a c programs for 7 different platforms (Linux + Mac + Windows + FreeBSD + OpenBSD 7.3 + NetBSD + BIOS) at one go.

A quick glance at promises

pledge.com -p 'stdio rpath inet dns tty sendfd recvfd'
curl -s http://itsfoss.com

That’s where the tool, Pledge, comes in. Pledge restricts the system calls a program can make. Pledge is natively supported on OpenBSD systems. Although it isn’t officially supported on Linux systems, I’ll show you a cool hack to utilize pledge on your Linux systems.

Porting OpenBSD pledge() to LinuxSandboxing for Linux has never been easier.

Conclusion

🚧pledge.com -p 'stdio rpath inet dns tty sendfd recvfd'
curl -s https://itsfoss.com

Read moreNSX-T Tier-1 Service Router (SR) Placement

To know what other promises are supported by the pledge binary, head over to this blog.