Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

OpenBSD doesn't have proper sandboxing. If you download malware it can easily steal and upload your ssh keys.


There is a package repository where many of the packages have been "pledged" and "unveiled", meaning that they execute with fewer unneeded privileges. And a general lack of privilege escalation exploits in base. And privilege separate by running things as distinct users. So jails might be less needed or less helpful by comparison, overall. There are chroot jails though, not sure why anyone would think they are not available in OBSD.


> proper sandboxing

Do jails not fulfill this?


Yes, among other protections that are even more convenient or built in. https://www.openbsd.org/security.html


OpenBSD doesn't have jails. Jails take effort to setup. It's much easier to just run the malware instead of going through the effort of making a jail for it.


It certainly has chroot jails, and many other protections. You might find interesting: https://www.openbsd.org/security.html .

ps: see also: https://man.openbsd.org/?query=chroot&apropos=1&sec=0&arch=d...




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: