Muva nje, umbhali we-Cosmopolitan C standard library kanye ne-platform ye-Redbean umemezele ukusetshenziswa kwendlela yokuhlukanisa i-pledge() ye-Linux.
Ekuqaleni yasungulwa yiphrojekthi ye-OpenBSD , isithembiso sikuvumela ukuthi uvimbele ngokukhetha izinhlelo zokusebenza ekufinyeleleni izingcingo zesistimu ezingasetshenziswanga (ukudala uhlu olumhlophe lwezingcingo zesistimu zohlelo lokusebenza kanye nokuvimbela ezinye izingcingo). Ngokungafani nezindlela zokulawula ukufinyelela ze-syscall ezitholakala ku-Linux, njenge-seccomp, isithembiso sakhiwe kusukela phansi ukuze sibe lula ukuyisebenzisa ngangokunokwenzeka.
Isinyathelo esihlulekile sokuhlukanisa izinhlelo zokusebenza endaweni eyisisekelo ye-OpenBSD kusetshenziswa indlela ye-systrace kubonise ukuthi ukuhlukaniswa ezingeni lezingcingo zesistimu ngayinye kuyinkimbinkimbi kakhulu futhi kudla isikhathi.
Ngaphandle kwalokho, kwaphakanyiswa isifungo, esavumela ukudala imithetho yokuhlukaniswa ngaphandle kokuchaza imininingwane kanye nokulawula amakilasi okufinyelela alungiselelwe.
Isibonelo, amakilasi ahlinzekwayo yi-stdio (okokufaka/okuphumayo), i-rpath (amafayela afundwayo kuphela), i-wpath (bhala amafayela), i-cpath (dala amafayela), i-tmppath (sebenza ngamafayela esikhashana), i-inet (inethiwekhi yamasokhethi), i-unix (amasokhethi angu-unix ), dns (DNS resolution), getpw (funda ukufinyelela kusizindalwazi somsebenzisi), ioctl (i-ioctl call), i-proc (ukulawula inqubo), khipha (izinqubo zokuqalisa), kanye ne-id (ukulawula imvume).
Imithetho yokusebenza ngezingcingo zesistimu ichazwe ngesimo sezichasiselo ezifaka uhlu lwamakilasi ocingo lwesistimu avunyelwe kanye nezindlela eziningi zamafayela lapho ukufinyelela kuvunyelwe khona. Ngemva kokuhlanganisa nokusebenzisa uhlelo lokusebenza oluguquliwe, i-kernel ithatha umsebenzi wokuqapha ukuhambisana nemithetho ecacisiwe.
Ngokwehlukana, ukuqaliswa kwesithembiso se-FreeBSD kuyathuthukiswa, okuhlukaniswa ikhono lokuhlukanisa izinhlelo zokusebenza ngaphandle kokwenza izinguquko kukhodi yazo, kuyilapho ku-OpenBSD ucingo lwesibambiso luhloselwe ukuhlanganiswa okuqinile nendawo eyisisekelo kanye nokwengezwa kwezichasiselo kukhodi. ngamunye ngamunye.
Isibambiso sifana nesithelo esinqatshelwe sonke esisifisayo lapho umphathi ethi kufanele sisebenzise izinto ezifana neLinux. Kubaluleke ngani lokho? Kungenxa yokuthi isibambiso() empeleni senza ukuphepha kuqondakala. I-Linux ayikaze ibe nesendlalelo sokuphepha esingaqondwa abantu abafayo.
Abathuthukisi bechweba lesithembiso se-Linux balandele isibonelo se-FreeBSD , futhi esikhundleni sokwenza izinguquko zekhodi, balungiselele uhlelo olwengeziwe oluvela ku-pledge.com olukuvumela ukuthi usebenzise imikhawulo ngaphandle kokushintsha ikhodi yakho yohlelo lokusebenza. Isibonelo, ukuze usebenzise uhlelo lwe-curl ngokufinyelela kuphela kumakilasi okushayela ucingo lwesistimu i-stdio, i-rpath, i-inet, kanye ne-threadstdio, mane usebenzise i-`./pledge.com -p 'stdio rpath inet thread' curl http://example.com`.
Le nsizakalo isebenza kuzo zonke izinsiza ze-Linux kusukela ku-RHEL6 kuya phambili futhi ayidingi ukufinyelela kwezimpande. Ngaphezu kwalokho, ngokusekelwe kulabhulali ye-cosmopolitan, i-API inikezwa ukuphatha imikhawulo kukhodi yohlelo lwe-C, okuvumela, phakathi kwezinye izinto, ukudalwa kwama-enclaves ukuze kukhawulelwe ngokukhetha ukufinyelela kwimisebenzi ethile yohlelo lokusebenza.
Kube khona onjiniyela abambalwa esikhathini esidlule abazame lokhu. Ngeke ngiwasho amagama, ngoba iningi lala maphrojekthi alikaze liqedwe. Uma kuza ku-SECOMP, okokufundisa okuku-inthanethi kuchaza kuphela ukuthi ungagunyazwa kanjani amakholi wesistimu, ukuze abantu abaningi balahlekelwe isithakazelo ngaphambi kokuthola ukuthi zihlungwa kanjani izimpikiswano. Amaphrojekthi aqhubekele phambili nawo abe nokugada okufana nokuvumela i-setuid/setgid/sticky bits ukuthi ishintshwe. Ngakho-ke, akukho okunye kwamanje okufanele kusetshenziswe. Ngicabanga ukuthi lo mzamo usisondeza kakhulu ekubeni ne-pledge() kunangaphambili.
Ukuqaliswa akudingi izinguquko ze-kernel: izithiyo zokusetshenziswa zihunyushwa emithethweni ye-SECCOMP BPF futhi zicutshungulwe kusetshenziswa indlela ye-Linux yomdabu yokuhlukanisa ikholi. Isibonelo, ukubiza isithembiso("stdio rpath", 0) kuzoguqulela kusihlungi se-BPF
Okokugcina, uma unesithakazelo sokufunda okwengeziwe, ungathola imininingwane kusixhumanisi esilandelayo.