For FreeBSD, a mechanism for isolation is being developed, similar to plegde and unveil.
An implementation of an application isolation mechanism similar to the system calls pledge and unveil developed by the OpenBSD project has been proposed for FreeBSD. Isolation in pledge is achieved by prohibiting access to unused system calls in the application, while unveil selectively opens access only for specific file paths that the application may work with. For the application, a semblance of a whitelist of system calls is formed and […]
