Kucwangcisiwe ukufaka isibhambathiso sokubekelwa bucala kwiLinux

Mva nje umbhali wethala leencwadi elisemgangathweni leCosmopolitan C kwaye iqonga leembotyi eziBomvu labhengezwa nge ibhengezwe, ukuphunyezwa kwesibhambathiso () sokwahlulwa kwendlela yeLinux.

Kwakunjalo yaphuhliswa ekuqaleni yiprojekthi ye-OpenBSD y ikuvumela ukuba ukhethe ukuvala ukuba izicelo ukufikelela kwiifowuni ezingasetyenziswanga inkqubo (uhlobo loluhlu olumhlophe lweefowuni zesixokelelwano lwenziwa ukwenzela isicelo kwaye ezinye iifowuni azivumelekanga). Ngokungafaniyo neendlela zolawulo lofikelelo lwe-syscall ezikhoyo kwi-Linux, njenge-seccomp, indlela yesibambiso iyilwe ukusuka phantsi ukuya phezulu ukuze isebenziseke ngokulula kangangoko.

Inyathelo elingaphumeleliyo lokwahlula izicelo kwindawo yesiseko se-OpenBSD kusetyenziswa indlela ye-systrace ibonise ukuba ukwahlulwa kwinqanaba leefowuni zenkqubo nganye kunzima kakhulu kwaye kudla ixesha.

Njengenye indlela, kwacetywa isibhambathiso, esathi kuvunyelwe ukudala imithetho yokwahlula ngaphandle kokungena kwiinkcukacha kunye nokukhohlisa iiklasi zokufikelela ezilungiselelwe.

Umzekelo, iiklasi ezibonelelwayo zezi stdio (igalelo/isiphumo), rpath (funda kuphela iifayile), wpath (bhala iifayile), cpath (yenza iifayile), tmppath (ukusebenza ngeefayile zethutyana), inet (sockets network), unix (unix sockets). ), i-dns (isisombululo se-DNS), i-getpw (ukufikelela kwi-database yomsebenzisi), ioctl (i-ioctl call), i-proc (inkqubo yolawulo), i-exec (iinkqubo zokuqalisa), kunye ne-id (ulawulo lwemvume).

Imigaqo yokusebenza ngeefowuni zenkqubo zikhankanyiwe ngendlela yezichasiselo ezibandakanya uluhlu lweendlela ezivunyelweyo kwiiklasi zokufowuna kunye noluhlu lweendlela zefayile apho ufikelelo luvunyelwe. Emva kokuqulunqa kunye nokuqhuba isicelo esilungisiweyo, i-kernel ithatha umsebenzi wokubeka iliso ukuthotyelwa kwemigaqo echaziweyo.

Ngokwahlukileyo, ukuphunyezwa kwesibambiso se-FreeBSD siyaphuhliswa, esahlulwe ngokukwazi ukwahlula izicelo ngaphandle kokwenza utshintsho kwikhowudi yazo, ngelixa kwi-OpenBSD umnxeba wesibambiso ujolise ekudityanisweni okuqinileyo kunye nesiseko esisingqongileyo kunye nokongezwa kwezichasiselo kwikhowudi. nganye nganye.

Isibambiso sifana nesiqhamo esalelweyo sonke esibawelayo xa umphathi esithi kufuneka sisebenzise izinto ezifana neLinux. Kutheni ibalulekile nje loo nto? Kungenxa yokuba isibambiso () eneneni senza ukhuseleko luqondeke. I-Linux ayizange ikhe ibenomaleko wokhuseleko onokuqondwa ngabantu nje.

Abaphuhlisi bezibuko ze-Linux bathathe ingcebiso kwiFreeBSD kwaye endaweni yokwenza utshintsho lwekhowudi, balungiselela usetyenziso olongezelelweyo oluvela kwi-pledge.com ekuvumela ukuba usebenzise izithintelo ngaphandle kokutshintsha ikhowudi yesicelo. Umzekelo, ukusebenzisa i-curl eluncedo ngofikelelo kuphela kwi-stdio, rpath, inet, kunye neeklasi zokufowuna kwenkqubo ye threadstdio, sebenzisa ngokulula "./pledge.com -p 'stdio rpath thread inet' curl http://example.com » .

Isixhobo sisebenza kuzo zonke izinikezelo zeLinux ukusukela kwiRHEL6 kwaye ayifuni ukufikelela kweengcambu. Ukongezelela, ngokusekelwe kwilayibrari ye-cosmopolitan, i-API inikezelwa ukulawula izithintelo kwikhowudi yeenkqubo zolwimi lwe-C, evumela, phakathi kwezinye izinto, ukudala i-enclaves ngokukhetha ukukhawulela ukufikelela ngokumalunga nemisebenzi ethile yesicelo.

Bekukho abaphuhlisi abambalwa kwixesha elidlulileyo abaye bazama oku. Andizukuchaza amagama, kuba uninzi lwezi projekthi zange zigqitywe. Xa kuziwa kwi-SECOMP, ii-tutorials ze-intanethi zichaza kuphela indlela yokubiza iifowuni ze-whitelist, ngoko ke abantu abaninzi balahlekelwa ngumdla ngaphambi kokuba bacinge indlela yokucoca iingxabano. Iiprojekthi eziye zaya phambili zikwanokongamela njengokuvumela i-setuid/setgid/sticky bits ukuba itshintshwe. Ke ngoko, akukho nanye kwezi ndlela zangoku ekufuneka isetyenziswe. Ndicinga ukuba lo mzamo usisondeza kakhulu ekubeni ne-pledge() kunangaphambili.

Ukuphunyezwa kufuna akukho tshintsho lwekernel: izithintelo eziluncedo ziguqulelwa kwimithetho ye-SECCOMP ye-BPF kwaye iqhutywe kusetyenziswa inkqubo yemveli ye-Linux yokubeka umnxeba wendlela yokwahlula. Umzekelo, ukufowuna isithembiso("stdio rpath", 0) iya kuguqula kwisihluzi se-BPF

Okokugqibela, ukuba unomdla wokwazi okungakumbi ngayo, unokujonga kwiinkcukacha Kule khonkco ilandelayo.


Umxholo wenqaku uyabambelela kwimigaqo yethu imigaqo yokuziphatha yokuhlela. Ukuxela impazamo cofa apha.

Yiba ngowokuqala ukuphawula

Shiya uluvo lwakho

Idilesi yakho ye email aziyi kupapashwa.

*

*

  1. Uxanduva lwedatha: UMiguel Ángel Gatón
  2. Injongo yedatha: Ulawulo lwe-SPAM, ulawulo lwezimvo.
  3. Umthetho: Imvume yakho
  4. Unxibelelwano lwedatha: Idatha ayizukuhanjiswa kubantu besithathu ngaphandle koxanduva lomthetho.
  5. Ukugcinwa kweenkcukacha
  6. Amalungelo: Ngalo naliphi na ixesha unganciphisa, uphinde uphinde ucime ulwazi lwakho.