> The difference is that while Capsicum provides you with very solid, ...
... That nothing uses. And even their flagship research example, Chrome, has never made it into the FreeBSD ports tree.
OpenBSD has pledge(2)/unveil(2) for Chrome.
... That nothing uses. And even their flagship research example, Chrome, has never made it into the FreeBSD ports tree.
OpenBSD has pledge(2)/unveil(2) for Chrome.
The problem with Chrome is not that it’s hard to capsicumize - it’s not, it has been done and documented - but rather that the upstream developers are extremely uncooperative wrt accepting patches.
Google not accepting this upstream is a separate issue, albeit regretful, OpenBSD maintains the pledge/unveil patches and users benefit from this work today, whereas FreeBSD users cannot run Capsicum-ised Chrome.
Capsicum patches are also considerably more intrusive, and their intention and protection is less clear.