[Cryptography] In the latest unexpected ransomware twist ...

[John-Mark Gurney]

Viktor Dukhovni wrote this message on Mon, Jun 14, 2021 at 01:58 -0400:
> On Sun, Jun 13, 2021 at 10:16:28PM -0700, Jonathan Thornburg wrote:
> 
> > The OpenBSD ports of firefox, chrome, et al, call this in their
> > startup code, setting things up so that (among other restrictions)
> > they can't access any of the home-directories filesystem except for a
> > single designated directory (typically ~/Downloads).
> > 
> > I don't know what other Unix flavors have similar facilities.
> 
> FreeBSD has "capsicum":
> 
>     https://www.freebsd.org/cgi/man.cgi?query=cap_enter&sektion=2&n=1
> 
> but neither unveil() nor cap_enter() is sufficient.  If it is possible
> to download and save files, we also need hard limits on any code
> executed as a side-effect of openining or running said files.
> Otherwise, the protections is ultimately still porous.

Well, at least for capsicum, a process that has entered capsicum
cannot execute another file w/ more permissions than originally
granted..  and it can further restrict it by closing fd's, etc before
exec..

Now if you go and run said program outside of a sandbox, etc, well,
that you intentionally bypassing the restrictions, and I think most
people don't want to disallow that..

-- 
  John-Mark Gurney				Voice: +1 415 225 5579

     "All that I will do, has been done, All that I have, has not."