Slashdot Mirror
A Highly Portable Sandbox Facility For OpenBSD
An Anonymous Coward writes: "A new facility called 'systrace' has been developed by one of the OpenBSD developers. It allows enforcement of system call policies on untrusted binaries. For now it is only available OpenBSD-current, but the author claims it is highly portable and can easily be integrated into GNU/Linux systems. Eventually binary-only software is going to become more and more common in Linux, so this could be a another 'Good Thing(TM)' from the paranoids that brought us OpenSSH."
What sort of performance hit does this impose? For instance, is it low enough to run nearly everything in the sandbox as a matter of course?
Protoplasm. Quiet Protoplasm. I like quiet protoplasm.
BSD vs Linux:
They say a picture is worth 1000 words. I'll let the pictures do the talking.
Look who shows up when BSD users get together. Now look what happens when Linux users get together. That's right! They immdiately start buggering each other! This picture shows the reaction of the receiver of such activity. A smile from ear to ear.
Note the look of disgust when a member of the BSD crowd actually has to look at a Linux user. Truly truly sad.
I seem to remember Lucent making something similar to this a few years back that could encapsulate a binary to stop buffer overflows. I know that's not the same, but it is similar. I'm too lazy to look for a link, so one of you karma whores (smnolde) can dig up a link.
This is really a great advacement for security. I hope it will be ported to Linux as soon as possible.
/home and /tmp.
/etc or /sbin for any user.
With this mechanism, basically every program can be sandboxed. Basically it would be very useful to restrict the access to the filesystem: applications do not need to access certain directories, or even better they should only access
Still the permissions should be defined mainly at system level: for example the mozilla binary must not be allowed to access
Does this isolate the programs from each other like Jail in FreeBSD or is it more of a system protection?
I've messed around with jail in FreeBSD and see there is a porting to Linux. Nice to see this in OpenBSD. Hey Microsoft, what have you got?
EA David Gardner -"... but the consumers have proven that actually what they want is fun."
This sounds like a great idea - however, on OpenBSD, how useful could this be? I don't know of any program that is released as a "binary-only" for OpenBSD. In Linux this could definately useful, as there are many binary only programs. It seems to me that with OpenBSD, you are basically required to compile. Which isn't really a problem - as long as you only want to use OSS.
(Reposted from an earlier story -- worth reading.)
It is now official - a Slashdot poll has confirmed: Slashdot is dyingYet another crippling bombshell hit the beleaguered Slashdot community when recently a poll on the site confirmed that up-to-date and factually-correct stories account for less than 40 percent of all submitted news stories, that the user-moderation system has fallen to pieces through the oppressive power of the editors, and that subscribers don't need to pay and can use such software as JunkBuster to filter out adverts. Coming on the heels of the latest MSNBC survey which plainly states that Slashdot has lost more readers, this news serves to reinforce what we've known all along. Slashdot is collapsing in complete disarray, as further exemplified by failing dead last in the recent Kuro5hin technology site popularity test.
You don't need to be a Kreskin to predict Slashdot's future. The hand writing is on the wall: Slashdot faces a bleak future. In fact there won't be any future at all for it because Slashdot is dying. Things are looking very bad for the site. As many of us are already aware, Slashdot continues to lose readers. Red ink flows like a river of blood. The subscribers scheme is the most endangered of them all, having lost 62% of its paying readers.
Let's keep to the facts and look at the numbers.
Slashdot editor and homosexual-rights campaigner Rob Malda (CmdrTaco) states that there are 700 paying subscribers to Slashdot. How many normal readers are there? Let's see. The number of subscriber versus reader posts on Slashdot is roughly in ratio of 1 to 4. Therefore there are about 700*4 = 2800 normal casual readers. Anonymous Coward posts are about half of the volume of the typical posts. Therefore there are about 1400 readers who can't be bothered setting up an account. A recent article put the Trolls, who post sexual insults, foul ASCII art pictures and links to vile sites, at about 80 percent of the Slashdot readership. Therefore there are (700+8400+4200)*4 = 19600 trolling readers. This is consistent with the number of Troll posts.
Due to the troubles of Andover.net, abysmal hit counts and so on, Slashdot went out of business and was taken over by OSDN who run another troubled site. Now OSDN is also dead, its corpse turned over to yet another charnel house.
All major surveys show that Slashdot has steadily declined in readership. It is very sick and its long term survival prospects are very dim. If Slashdot is to survive at all it will be among geeky hobbyist dabblers. Slashdot continues to decay. Nothing short of a miracle could save it at this point in time. For all practical purposes, Slashdot is dead.
So why now? Why did Slashdot fail? Once you get over the myriad of incompatible personalities, particularly among the editors who have repeatedly failed to check for serious inaccuracies in their stories (see the FreeBSD 4.5 "release" as a shocking example), it's clear that subscribers will continue to decrease. Using software such as JunkBuster, readers can eliminate adverts without having to pay any money. These two significant factors, along with the corrupted "moderation" scheme (where editors have infinite power over the regular moderators), only confirm yet further that Slashdot's glory days are coming to an end.
Fact: Slashdot is dying
This isn't a really novel project as it has allready been done by David Wagner and Tal Garfinkel. I highly recommend people read the Janus paper located at the bottom of this page. They did something very similar although it uses some funny Solaris /proc interface hack. Notice that the paper presents the exact same idea for isolating web browsers. This Systrace mechanism seems a bit more complete though.
I like that idea, though I see would be a more useful thing in Linux or FreeBSD than in OpenBSD. For those of you that use NetBSD, there's an exec denier (restircts specified users from executing things in /sbin, /usr/sbin, etc.) and there's a jail module as well which restricts processes, such as jailing ssh and running top in an ssh session will disallow you to see other processes other than your own - Both of which are kernel modules (LKM).
As for binary-only software in Linux, I don't believe the number of binary only applications will increase very much more other than commercial or restricted licensed apps.
Isn't that what the Linux Standards Base is for?
IMHO, however, I almost always compile from source, especially with a new piece of software, though if you're running less powerful hardware it can be a bit of a drag.
"it is highly portable and can easily be integrated into GNU/Linux systems"
Otherwise it wouldn't be newsworthy.
User Mode Linux
It's part of OBSD. You have to crank through a kernel mod to use it. And it's still "highly portable?" Sure, and command line Linux is "user friendly" and Winblows is "highly secure."