alt Hacker NewsJust as another point of comparison, FreeBSD's version seems somewhere in-between. It also enables a Capsicum sandbox before processing any data, akin to what the OpenBSD version does with pledge.
[1] https://github.com/freebsd/freebsd-src/blob/main/usr.bin/yes...
Replies
rootnod3 • yesterday at 3:55 PM
And yes, I went into that a while ago on my blog (https://blog.wollwage.com/2026/20260212-daily-source-reading...)
Difference is that capsicum is after the fact and mostly about file descriptors. You need to open them in advance and _then_ call capsicum. But it does nothing about syscalls.
Capsicum is really nice if you plan ahead, but pledge/unveil is easy to drop into any existing code base.