Failfs is a pretty cool pseudo-filesystem where every path lookup fails. So if yu place a statically-linked process into failfs with ONLY pre-allocated file-descriptors at process birth, close down unneeded sockets and enforce a default-deny firewall discipline, compromised applications are effectively isolated and unable to access local files or spawn shells during an exploit. An attacker can NOT move adjacently from the exploited process to other parts of the system because to do so they'll need to navigate from root and that would fail since yu set root as failfs and you've got yourself a pure, isolated data-processing pipe that can only interact via the exact file descriptors it was given!!

Unfortunately, yu can't use dynamically-linked apps anyway since failfs would break absolute path resolution loading system libraries.

EDIT:: But I guess yu could put a statically linked app on the socket, wrap it in failfs and gave it proxy requests to a dynamically-linked app process if your app must use something like python.

▲

wpyoga 4 hours ago | parent | next [-]

Is it possible to load the dynamic libraries before fork()ing and somehow prevent the path lookup and library loading? This will open up new possibilities for hardened security models.

▲

saint-evan 4 hours ago | parent [-]

That's a fun idea but take python (very familiar)... It's very deeply dynamic and even if yu run imports at the top of your code yu still have many large libs with lazy code execution baked deep inside their internal functions so that assumes yu actually know what code paths the application will hit later. More importantly this goes in the opposite direction of Python's lazy imports thingy.. basically you've got a bomb and yu wouldn't wanna do that. Also, imagine the startup time for large apps. I'd just put a statically-linked binary in front and proxy back to the dynamically-linked process if I can't rewrite the main app in something like Go or Rust.

	▲	ffsm8 2 hours ago \| parent [-]
		You explicitly stated as such, I just want to emphasize it again: it only breaks dynamically linked libraries, which - from a stability point of view - is an antipattern anyway. Almost always youre better off producing a bundle which has everything (excluding the runtime) included... Or just use better languages which categorically don't even have this scenario, eg golang, Java, rust, etc pp

▲

dhx 2 hours ago | parent | prev | next [-]

Is it different from using seccomp with SECCOMP_RET_ERRNO and return code of EOPNOTSUPP for all filesystem syscalls?

▲

jack_pp 4 hours ago | parent | prev | next [-]

idk if it's just me but deliberately using "yu" instead of "you" is annoying and makes me not really take whatever you say seriously

	▲	Nexxxeh 2 hours ago \| parent \| next [-]
		Yeah, it feels "not ND friendly" too. Totally breaks my reading flow. I am the person addressed when someone says "you", not "yu". Why is that person changing how I'm addressed? It's also confusing because it feels initially like it's some new Linux command or user, like "su".
	▲	tgv 2 hours ago \| parent \| prev [-]
		Lil' TAFKAP, the modern version of Saint Exupery.

▲

pandemic_region 4 hours ago | parent | prev [-]

Sorry man I've been out of the loop with the hip crowd for a good while, but is "yu" now a thing like "thru" once was?

▲

saint-evan 4 hours ago | parent [-]

no biggie... I just like how 'yu' looks. It's an aesthetic.

▲

pandemic_region 3 hours ago | parent [-]

Thanks, at first I thought it was the name of another tool or library ;)

	▲	asimovDev 3 hours ago \| parent [-]
		I immediately parsed it as some CLI i don't know about as well