#unveil — Public Fediverse posts

OpenBSD's pledge(2) and unveil(2) are developer-friendly, study finds https://www.undeadly.org/cgi?action=article;sid=20260708055608 #openbsd #security #pledge #unveil #development #programming

Built an AI agent harness on OpenBSD 7.8, as a test and - because why not(?)
It's 198 agents. 198 UNIX users. One kernel.

Each job runs through a setuid C wrapper:
chroot(2) → unveil(2) → pledge(2) → execve(2)
PF handles per-department egress. Every syscall is logged.

Idle agents cost zero RAM. They're just directory entries until the executor calls them up. No containers. No VMs. No orchestrator bloat.
Just OpenBSD being exactly what it was built to be. ❤️

More people should know this OS is the ultimate AI harness. 🐡

#OpenBSD #pledge #unveil #pf #BSD #AI #agenticAI

We are on #LinuxDays! Come to our #stand to talk to us about our #opensource #wifi #router or our #security #research program #Sentinel! But this year we will also have a big #unveil today at 10:30, more about that later 😉

Are you eager to know what is the #future of #Turris? Visit our #booth this weekend during @linuxdays in #Prague and be among the first ones to see the new #OmniaNG IRL! New #powerful #opensource #secure #wifi #router is here! Big #unveil this Saturday (unveil at 10:30 in Czech, recap in English at 13:00), online stream and recordings will be available https://www.linuxdays.cz/2025/program/
#LinuxDays #Conference

Making openat(2) and friends more useful in practice https://www.undeadly.org/cgi?action=article;sid=20250529080623 #openbsd #openat #open #filesystems #security #development #unveil - now also with regression tests, more discussions on tech@

ssh: listener sockets relocated from /tmp to ~/.ssh/agent https://www.undeadly.org/cgi?action=article;sid=20250506044643 #openbsd #ssh #openssh #security #unveil #sshagent #snoopresistant #freesoftware #libresoftware

🚨BREAKING: The art world is SHOOK as a #museum unveils a 108 billion pixel scan of 'Girl with a Pearl Earring', because obviously what #Vermeer really needed was more #pixels and some JavaScript errors. 🤦‍♂️ Because nothing says "appreciate classic art" like cramming it into a digital microscope. 🔍🎨
https://www.hirox-europe.com/gigapixel/girl-with-a-pearl-earring/ #artworld #digitalart #unveil #GirlWithAPearlEarring #HackerNews #ngated

Archaeological Discoveries Unveil the Fabled Demise of a West African Empire #WestAfrica #Africa #African #Archaeological #Arts #business #CultureandEntertainment #currentevents #Demise #Discoveries #Economy #Empire #Fabled #Gambia #governance #GuineaBissau #news #Nigeria #politics #sports #trade #travel #unveil #West #WestAfrica 
https://tinyurl.com/2cjasndj

Concentric AI to Unveil Data Security Remediation and Compliance Reporting Capabilities at Infosecurity Europe 2024 – Source: www.darkreading.com https://ciso2ciso.com/concentric-ai-to-unveil-data-security-remediation-and-compliance-reporting-capabilities-at-infosecurity-europe-2024-source-www-darkreading-com/ #rssfeedpostgeneratorecho #DarkReadingSecurity #CyberSecurityNews #DARKReading #Unveil

CISA and Partners Unveil Cybersecurity Guide For Civil Society Groups – Source: www.infosecurity-magazine.com https://ciso2ciso.com/cisa-and-partners-unveil-cybersecurity-guide-for-civil-society-groups-source-www-infosecurity-magazine-com/ #rssfeedpostgeneratorecho #InfoSecurityMagazine #InfosecurityMagazine #CyberSecurityNews #partners #Unveil

Is there a way to secure popen(3) in #OpenBSD #unveil(2)? My use case is an upstream program that calls

popen("/usr/sbin/sendmail -t", "w")

to send an email. I don't need to unveil sendmail(8) itself, but /bin/sh instead, since popen runs the command in a shell. Obviously, if the program misbehaves, it can do an awful lot more now it has access to /bin/sh.

I've a feeling that the only way to secure it is to replace popen with pipe+fork+execl, but I'd be very grateful for something simpler! 😊

#BSDCan Talk: Unveil in #OpenBSD
The Unveil system call, it's use in Programs, and new semantics for it
by Bob Beck
https://youtu.be/gvmGfpMgny4
More Info:
https://www.bsdcan.org/2019/schedule/events/1094.en.html
#Unveil

#unveil in #OpenBSD has been applied to #Chrome.

Chrome cannot read ~/.ssh, but it can downloads files to ~/Downloads

Can't. Wait. For. 6.4.

#OpenBSD #StillRunningStable #pledge #unveil

https://marc.info/?l=openbsd-ports-cvs&m=153391307802429&w=2