Kwamenyezelwa ukuthi kuphakanyiswe ukusetshenziswa kwendlela yokuhlukanisa uhlelo lokusebenza ye-FreeBSD , okukhumbuza izingcingo zesistimu ye-foldde kanye ne-unveil ezakhiwe yiphrojekthi ye-OpenBSD.
Ukuzihlukanisa ku-plegde kwenziwa ngokuvimbela ukufinyelela kumakholi wesistimu angasetshenziswa uhlelo lokusebenza nokudalula ngokukhetha ngokuvula ukufinyelela ezindleleni ezithile zefayela uhlelo lokusebenza olungasebenza ngazo. Ngohlelo lokusebenza, kwakhiwa uhlobo lohlu olumhlophe lwezingcingo zesistimu nezindlela zefayela, futhi zonke ezinye izingcingo nezindlela azivunyelwe.
Umehluko phakathi kwe-`pledge` kanye ne-`unveil` , eyenzelwe i-FreeBSD , uphelela ekuhlinzekeni ungqimba olwengeziwe oluvumela izinhlelo zokusebenza ukuthi zihlukaniswe ngezinguquko ezincane noma ezingenazo nhlobo kukhodi yazo. Khumbula ukuthi ku-OpenBSD, i-`pledge` kanye ne-`unlock` zihlose ukuhlanganiswa okuqinile nendawo eyisisekelo futhi zenziwa ngokungeza izichasiselo ezikhethekile kukhodi yohlelo lokusebenza ngalunye.
Ukwenza kube lula ukuhlelwa kokuvikela, izihlungi zikuvumela ukuthi ugweme imininingwane esezingeni lezingcingo zesistimu ngayinye futhi ulawule izigaba zezingcingo zesistimu (okufakwayo/okuphumayo, ukufundwa kwefayela, ukubhalwa kwefayela, amasokhethi, ioctl, i-sysctl, ukuqala kwezinqubo, njll.) . Imisebenzi yokuvinjelwa kokufinyelela ingabizwa ngekhodi yesicelo njengoba kwenziwa izenzo ezithile, isibonelo, ukufinyelela kumasokhethi namafayela kungavalwa ngemva kokuvula amafayela adingekayo nokusungula uxhumano lwenethiwekhi.
Umbhali we-FreeBSD port of folding and unlearning uhlose ukunikeza ikhono lokuhlukanisa izinhlelo zokusebenza ezingahleliwe. Ukuze bafeze lokhu, baphakamisa ukusetshenziswa kwekhethini, okuvumela ukusebenzisa imithetho echazwe kufayela elihlukile kuzinhlelo zokusebenza. Ukucushwa okuphakanyisiwe kufaka ifayela elinezilungiselelo eziyisisekelo ezichaza amakilasi ezingcingo zesistimu kanye nezindlela ezijwayelekile zamafayela ezithile kuzinhlelo zokusebenza ezithile (ukusebenza ngomsindo, ukuxhumana, ukuloga, njll.), kanye nefayela elinemithetho yokufinyelela yezinhlelo zokusebenza ezithile.
Umsebenzi wamakhethini ungasetshenziswa ukuhlukanisa izinsiza eziningi, izinqubo zeseva, izinhlelo zokusebenza zezithombe, kanye namaseshini edeskithophu yawo wonke angashintshwanga. Ukwabelana ngekhethini nezindlela zokuzihlukanisa ezihlinzekwa yi-Jail ne-Capsicum subsystems kuyasekelwa.
Ukuhlukaniswa okuhlanganisiwe nakho kungenzeka, lapho izinhlelo zokusebenza eziqalisiwe zizuza khona imithetho esungulwe uhlelo lokusebenza oluyinhloko, zinezela ngemikhawulo ehlukile. Eminye imisebenzi ye-kernel (amathuluzi okulungisa iphutha, i-POSIX/SysV IPC, i-PTY) ivikelwe kakhulu yindlela yokuvimbela evimbela ukufinyelela ezintweni ze-kernel ezidalwe yizinqubo ezingezona inqubo yamanje noma eyinhloko.
Inqubo ingalungiselela ukuhlukaniswa kwayo ngokubiza i-curtainctl noma ukusebenzisa imisebenzi ye-pledge() kanye ne-unveal() enikezwa yilabhulali ye-libcurtain, efana naleyo eku-OpenBSD. I-sysctl 'security.curtain.log_level' inikezwa ukulandelela ukukhiya ngenkathi uhlelo lokusebenza lusebenza.
Ukufinyelela kuzimiso ze-X11 kanye ne-Wayland kunikwe amandla ngokuhlukana ngokucacisa okukhethwa kukho okuthi "-X"/"-Y" kanye no-"-W" lapho kuqaliswa ikhethini, kodwa ukusekelwa kwezithombe akukazinzisiswa ngokwanele futhi kunochungechunge lwezinkinga ezingaxazululiwe ( izinkinga zivela ikakhulukazi uma usebenzisa i-X11, futhi ukusekelwa kwe-Wayland kungcono kakhulu). Abasebenzisi bangangeza imikhawulo eyengeziwe ngokudala amafayela emithetho yendawo (~/.curtain.conf). Ngokwesibonelo,
Ukuqaliswa kufaka imojuli ye-mac_curtain kernel yokulawula ukufinyelela okuyisibopho (MAC), isethi yeziqephu ze-FreeBSD kernel ngokusetshenziswa komshayeli nezihlungi ezidingekayo, umtapo wezincwadi we-libcurtain wokusebenzisa i-plegde nemisebenzi eveziwe kuzinhlelo zokusebenza, ikhethini lensiza, likhombisa ukucushwa. amafayela, uchungechunge lokuhlola, neziqeshana zezinhlelo ezithile zesikhala somsebenzisi (ngokwesibonelo, ukusebenzisa i-$TMPDIR ukuze uhlanganise ukusebenza ngamafayela esikhashana). Noma nini lapho kungenzeka, umbhali uzama ukunciphisa inani lezinguquko ezidinga ukuphetshwa i-kernel nezinhlelo zokusebenza.
Okokugcina, uma unesithakazelo sokufunda okwengeziwe , ungathola imininingwane kusixhumanisi esilandelayo.