Privilege Separation and Pledge
summary
OpenBSD adds a pledge(2) syscall that lets a process irrevocably restrict its POSIX surface and gets killed with a core dump on violation so developers can debug. Applying it to real privilege‑separated daemons (ntpd bgpd tcpdump and others) forces code changes: sockets get opened by callers and file descriptors are passed instead, revealing numerous design mistakes and validating the separation approach through file‑descriptor passing and concrete rewrites.
AI-written summary · about
chapters (10)
- 0:00Intro
- 0:40Many small changes to improve security
- 3:48Privilege Separation examples
- 4:51Defence in Depth
- 6:12Pledges are POSIX subsets
- 8:37Processes select own pledge - inline
- 9:09Good debugging experience
- 9:44Privsep mistakes identified
- 12:16Future work
- 13:49General Observation
related talks
57mBPF and Security. Friends and Foes
25mDrawing Lines in the Sand, or Running Unprivileged eBPF in Kubernetes
48mUnprivileged Access Control in AppArmor
32mLinux user namespaces: a blessing and a curse
01h 02mSandboxing a Linux Application
32meBPF: The Next Power Tool of SREs
36mPrivsep: A New Security Isolation Mechanism
36mHow to Safely Restrict Access to Files in a Programmatic Way with Landlock?