View Single Post
  #1   (View Single Post)  
Old 19th July 2015
jggimi's Avatar
jggimi jggimi is offline
More noise than signal
Join Date: May 2008
Location: USA
Posts: 7,034
Default Introducing tame(2) with OpenBSD 5.8

The tame(2) syscall is a new kernel facility, announced yesterday on the OpenBSD tech@ mailing list. It was announced there, rather than more broadly, because it is still a work in progress, and developments continue. As I write this, revisions to the tame(2) man page were committed within the last hour.

The tame(2) service will be available with OpenBSD 5.8 when released later this year. This new facility permits both fine-grained service restrictions, and restrictions that are different than chroot(2), and I expect both may be deployed together when appropriate.

The tame(2) syscall is an an application developer's tool to limit the scope of system services available to the application. At the moment, these types of service categories are defined in tame(2), which an application developer may select from:
  • pure computation services
  • memory management
  • file I/O operations
  • read operations
  • write operations
  • temporary file management
  • file and directory creation
  • network services
  • Unix socket services
  • Domain resolution services
  • user and group identity services
  • file descriptor message services
  • child process management
Once syscalls are restricted by tame(2), they cannot be reversed for the life of the tamed process. Any syscall requests that violate the requested restriction will result in a killed or aborted process, as the developer directs.

Last edited by jggimi; 21st July 2015 at 10:25 AM. Reason: typo
Reply With Quote