Differences

This shows you the differences between two versions of the page.

--- capsicum [2017/03/09 19:18] – Capsicumisation of praudit/auditreduce to be merged with new OpenBSM in due course RobertWatson
+++ capsicum [2022/11/07 17:12] (current) – ping6 and ping are now the same binary, and both use casper AlanSomers
@@ Line 1: / Line 1: @@
 ====== Capsicum technologies ======
 Capsicum consists of various technologies:
-  * Capability mode, see capsicum(4) and cap_enter(2) for more info.
+  * Capability mode, see [[https://man.freebsd.org/capsicum/4|capsicum(4)]] and [[https://man.freebsd.org/cap_enter/2|cap_enter(2)]] for more info.
-  * Capability rights for descriptors, see capsicum(4) and cap_rights_limit(2) for more info.
+  * Capability rights for descriptors, see [[https://man.freebsd.org/capsicum/4|capsicum(4)]] and [[https://man.freebsd.org/cap_rights_limit/2|cap_rights_limit(2)]] for more info.
-  * Casper daemon, casper services and libcapsicum(3) library, see casperd(8) and libcapsicum(3) for more info.  (CEM: None of these pages exist?)
+  * Casper daemon, casper services, see [[https://man.freebsd.org/libcasper/3|libcasper(3)]] and [[https://man.freebsd.org/capsicum_helpers/3|capsicum_helpers(3)]] for more info.
-  * Name-value pair library - libnv, which is a general purpose name-value pair library, see libnv(3) for more info.
+  * Name-value pair library - libnv, which is a general purpose name-value pair library, see [[https://man.freebsd.org/libnv/9|libnv(9)]] for more info.
 ====== More information, links ======
@@ Line 15: / Line 15: @@
   * [[http://oshogbo.vexillium.org/pdf/AsiaBSDcon2016.pdf|Article: Capsicum and Casper - a fairy tale about solving security problems]] at %%AsiaBSDCon%% 2016
   * [[https://www.youtube.com/watch?v=60HqpCvZaMA|Talk: Capsicum and Casper - a fairy tale about solving security problems]] at BSDCan 2016
+  * [[https://youtu.be/Lf8zJBDbZDg|Talk: Case studies of sandboxing base system with Capsicum]] by Mariusz Zaborski (%%EuroBSDcon%% 2017)
 ====== Existing examples to follow ======
-  * auditdistd(8),
+  * auditdistd(8) - Done,
   * auditreduce(8) (To be merged with new %%OpenBSM%% release)
-  * bspatch(1),
   * basename(1) (r308432),
+  * brandelf(1) (r340572),
+  * bspatch(1) - Done,
   * bhyve(8) [[https://reviews.freebsd.org/D8290|D8290]] (committed r313727, sponsored by Pawel Biernacki of Mysterious Code Ltd.)
   * cmp(1) [[https://reviews.freebsd.org/D7912|D7912]] (r305981),
-  * ctld(8),
+  * ctld(8) - Done,
   * col(1) (r282342),
   * dc(1) (r308432),
   * dd(1) [[https://reviews.freebsd.org/D8543|D8543]] (committed r309735, sponsored by Pawel Biernacki of Mysterious Code Ltd.)
-  * decryptcore(8),
+  * decryptcore(8) - Done,
-  * dhclient(8),
+  * dhclient(8) - Done,
   * dirname(1)(r308432),
   * dma-mbox-create [[https://reviews.freebsd.org/D7988|D7988]] (r310140),
-  * dumpon(8),
+  * dumpon(8) - Done,
   * echo(1) (r308432),
-  * elfdump(1),
+  * elfdump(1) - Done,
   * factor(6) [[https://reviews.freebsd.org/D7982|D7982]] (r306502),
   * fold(1) (r308432),
   * getopt(1) (r308432),
-  * hastd(8), hastctl(8),
+  * hastd(8) - Done, hastctl(8),
+  * head(1) r340376,
   * hexdump(1) [[https://reviews.freebsd.org/D7915|D7915]] (r310143),
   * indent(1) [[https://reviews.freebsd.org/D7920|D7920]] (r305983),
-  * iscsid(8),
+  * iscsid(8) - Done,
   * jot(1) [[https://reviews.freebsd.org/D1345|D1345]] (r307660),
   * last(1) [[https://reviews.freebsd.org/D8001|D8001]] (r310139),
   * locate(1) (r308432),
   * logname(1) (r308432),
-  * kdump(1),
+  * kdump(1) - Done,
   * ktrdump(8) [[https://reviews.freebsd.org/D7921|D7921]] (r310142),
   * md5(1) [[https://reviews.freebsd.org/D8271|D8271]] (r307658),
@@ Line 52: / Line 55: @@
   * praudit(8) (To be merged with new %%OpenBSM%% release)
   * primes(6) [[https://reviews.freebsd.org/D7982|D7982]] (r306502),
-  * ping(8),
+  * ping(8)/ping6(8) - Done,
   * printenv(1) (r308432),
-  * procstat(1),
+  * procstat(1) - Done,
-  * rwho(1),
+  * rtsol(8), rtsold(8) (r342788)
-  * rwhod(8),
+  * rwho(1) - Done,
+  * rwhod(8) - Done,
+  * savecore(8) (r342699)
   * sleep(1) (r308432),
   * soelim(1) [[https://reviews.freebsd.org/D7936|D7936]] (committed r305936)
-  * tcpdump(8),
+  * tcpdump(8) - Done,
   * tee(1) [[https://reviews.freebsd.org/D7940|D7940]] (committed r305937),
   * tr(1) [[https://reviews.freebsd.org/D7928|D7928]] (r305982),
   * traceroute(8) [[https://reviews.freebsd.org/D9303]] (r314000)
-  * units(1),
+  * units(1) - Done,
-  * uniq(1),
+  * uniq(1) - Done,
+  * wc(1) (r340374),
   * write(1) [[https://reviews.freebsd.org/D7999|D7999]] (r306761),
   * yes(1) (r308432).
@@ Line 70: / Line 76: @@
 ====== Candidate programs ======
 (should be relatively easy to sandbox using Capsicum)
-  * b64decode(1) [[https://reviews.freebsd.org/D7655|D7655]],
-  * b64encode(1),
-  * brandelf(1) [[https://reviews.freebsd.org/D7773|D7773]],
-  * compress(1) (CEM: Seems difficult.  Not only do the program's routines work specifically with filenames rather than fds, the program moves files around after doing the compression.  And the program works on an arbitrarily long list of filenames.),
   * crontab(1) (CEM: Also seems difficult.  Lots of filesystem interaction, stat(2).),
   * elf2aout(1) [[https://reviews.freebsd.org/D1331|D1331]],
-  * file(1) [[https://reviews.freebsd.org/D7734|D7734]],
   * finger(1) (CEM: Another difficult one.  Lots of surprising filesystem interaction hidden between libc calls; network interaction; arbitrary list of inputs.),
-  * head(1) [[https://reviews.freebsd.org/D7913|D7913]],
-  * jail(8),
-  * jexec(8),
   * jls(8),
-  * patch(1),
+  * true(1),
+  * xargs(1),
+  * dma(8).
+===== Multiple file arguments =====
+Some of those are more tricky, as they take multiple files as arguments and we don't want to open all of them at once before entering the sandbox.
+The best way to support this class of utilities is to provide a casperd service which can help iterate through all the files.
+  * b64decode(1) [[https://reviews.freebsd.org/D7655|D7655]],
+  * b64encode(1) [[https://reviews.freebsd.org/D11131|D11131]],
+  * compress(1) (CEM: Seems difficult.  Not only do the program's routines work specifically with filenames rather than fds, the program moves files around after doing the compression.  And the program works on an arbitrarily long list of filenames.),
+  * file(1) [[https://reviews.freebsd.org/D7734|D7734]],
+  * patch(1)
   * praudit(8) [[https://reviews.freebsd.org/D7926|D7926]],
   * sort(1),
@@ Line 89: / Line 99: @@
   * unzip(1),
   * uudecode(1) [[https://reviews.freebsd.org/D7655|D7655]],
-  * uuencode(1),
+  * uuencode(1) [[https://reviews.freebsd.org/D11131|D11131]],
-  * wc(1),
+  * xstr(1).
-  * xargs(1),
-  * xstr(1),
-  * dma(8).
-Some of those are more tricky, as they take multiple files as arguments and we don't want to open all of them at once before entering the sandbox.
-The best way to support this class of utilities is to provide a casperd service which can help iterate through all the files.
 ===== setuid / setgid binaries =====
@@ Line 118: / Line 122: @@
   * sbin/shutdown
   * sbin/mksnap_ffs
-  * sbin/ping6
   * usr.sbin/cron/crontab
   * usr.sbin/lpr/lprm