A few days ago I posted about Capsicum vs Pledge in dhcpcd. Well, I finished the Capsicum integration yesterday so I thought I would take some time to revisit my findings.
Capsicum is hard to develop for It’s either on or off. You can limit each FD with capabilites mode off, but I’m not sure what that gains as it’s mainly there to allow the FD to be used in the restricted world so we can treat it as either on or off really.
So one of the big goals of dhcpcd was to implement Privilege Separation. This was achieved in dhcpcd-9 which was important because it was a required step of work to merge dhcpcd into FreeBSD base system. Once done, we can then look at what is required to enable Capsicum support, which is the last required step before dhcpcd can even be considered for importing into FreeBSD base system.
The good news is that basic Capsicum support has been enabled in this commit by ensuring all the file descriptors of the network facing processes are limited in their capability.
So I just got this email and I thought I would share it verbatim:
I just wanted to thank you for such a great piece of software (dhcpcd)…
I often forget the people that make all this cool stuff that make linux. bsd and all the other unixes work… so rather sending a bug report, I’d just though i’d send you a hello! and thanks for giving my machines ip addresses!
My home server for a few years has been a Gigabyte BRIX 1900. Aside from powering this site, my email, project mailing lists and source code repositories, I use use it to host some VM’s as XEN DOMU HVM guests so I can ensure my code works on many operating systems. However, the VM hosting brought my server to it’s knees.
I’ve recently purchased an AMD 2600x which I’ve fitted out with 32GB RAM.
NetBSD PR lib/23910 was filed over 16 years ago. It describes how NetBSD curses fails to work with Vifm, a Vim interface for a curses GUI file manager. It’s quite a nice idea after playing around with it some as Vim is my favourite text editor.
Since I was the main protagonist in bringing terminfo to NetBSD, I had a reasonable grasp on how our curses worked and I had looked at this bug before, but left scratching my head over it.