Following on from Capsicum vs Pledge Part 2 I thought I would post my final thougts on the topic as the development on these sandbox technologies draws to a close in dhcpcd.
But first, let us discuss …
The POSIX Resource Limited sandbox POSIX documents setrlimit(2). Disabling the ability to open new files, sockets, etc, or create new processes is actually pretty powerful.
Thanks to the privsep dhcpcd now has to support both Capsicum and Pledge, this turned out to be pretty easy to implement.
A few days ago I posted about Capsicum vs Pledge in dhcpcd. Well, I finished the Capsicum integration yesterday so I thought I would take some time to revisit my findings.
Capsicum is hard to develop for It’s either on or off. You can limit each FD with capabilites mode off, but I’m not sure what that gains as it’s mainly there to allow the FD to be used in the restricted world so we can treat it as either on or off really.
So one of the big goals of dhcpcd was to implement Privilege Separation. This was achieved in dhcpcd-9 which was important because it was a required step of work to merge dhcpcd into FreeBSD base system. Once done, we can then look at what is required to enable Capsicum support, which is the last required step before dhcpcd can even be considered for importing into FreeBSD base system.
The good news is that basic Capsicum support has been enabled in this commit by ensuring all the file descriptors of the network facing processes are limited in their capability.