Hacker News Reader

Context: "I'm building a new sandboxing technology. Who here wants to hack into it?" From Justine Tunny (jart) https://twitter.com/JustineTunney/status/1670465543470710785...

"It's a SECCOMP + Landlock LSM implementation of OpenBSD pledge() and unveil(). Fully unprivileged sandboxing. No root or containers required."

A little more info for those not familiar with these terms (I was not):

1. pledge is a system call that a process can make that limits what subsequent system calls that process can execute, e.g. "I pledge to only call X, Y, Z": https://unix.stackexchange.com/questions/410056/what-is-open...

2. unveil is the analogous call to restrict filesystem paths: it limits which paths open is allowed to access: https://why-openbsd.rocks/fact/unveil/

@jart also made a writeup on porting pledge to Linux specifically in the cosmopolitan context: https://justine.lol/pledge/.