O le tusitala o le Cosmopolitan standard C faletusi ma le Redbean platform ua faʻasalalau le faʻatinoina o le faʻavae () faʻaesea mo Linux. O le tautoga na amataina e le OpenBSD poloketi ma faʻatagaina oe e filifili faʻasaina talosaga mai le faʻaogaina o telefoni feaveaʻi (o se ituaiga o lisi paʻepaʻe o telefoni feaveaʻi ua faia mo le talosaga, ma isi telefoni e faʻasaina). E le pei o le faiga fa'agata avanoa avanoa e maua i Linux, e pei o le seccomp, o le fa'atautoga masini na muai mamanuina ina ia faigofie ona fa'aoga.
O le le taulau o le faʻavaeina o talosaga i totonu o le OpenBSD base environment e faʻaaoga ai le systrace mechanism na faʻaalia ai o le faʻaesea i le tulaga o le telefoni feaveaʻi e faigata tele ma faʻaalu taimi. I se isi itu, sa tu'uina atu se tautoga, lea na mafai ai ona faia ni tulafono fa'a tu'ufua e aunoa ma le alu i fa'amatalaga ma le fa'aogaina o vasega avanoa ua saunia. Mo se faʻataʻitaʻiga, o vasega o loʻo ofoina atu o le stdio (input/output), rpath (faitau-na o faila), wpath (tusi faila), cpath (fausia faila), tmppath (galue ma faila le tumau), inet (sockets network), unix ( unix sockets), dns (DNS resolution), getpw (faitau le avanoa i le database user database), ioctl (ioctl call), proc (pulega faʻagasologa), exec (faʻagasolo faʻalauiloa) ma id (pulega aia tatau).
O tulafono mo le galue i telefoni feaveaʻi o loʻo faʻamaoti mai i le tulaga o faʻamatalaga, e aofia ai se lisi o vasega faʻatagaina o le telefoni feaveaʻi ma le tele o ala faila e faʻatagaina avanoa. A maeʻa ona fausia ma faʻalauiloa le faʻaogaina o le talosaga, e faʻatautaia e le fatu le galuega o le mataʻituina o le tausisia o tulafono faʻamaonia.
O loʻo faʻatulagaina se faʻatinoga eseʻese o le tautoga mo FreeBSD, lea e iloga i le mafai ona tuʻuesea talosaga e aunoa ma le faia o suiga i la latou code, ae i totonu o le OpenBSD o le tautoga o loʻo faʻatatau i le tuʻufaʻatasia faʻatasi ma le siosiomaga faʻavae ma faʻaopoopo faʻamatalaga i le code o taʻitasi. talosaga.
Na faia e le au atiaʻe le faʻailoga tautoga mo Linux le faʻataʻitaʻiga o le FreeBSD ma, nai lo le faia o suiga i le code, saunia se faʻaopoopoga faʻaoga pledge.com e faʻatagaina oe e faʻaoga tapulaʻa e aunoa ma le suia o le numera o talosaga. Mo se fa'ata'ita'iga, ina ia fa'agaoioia le fa'aogaina o le curl e na'o le stdio, rpath, inet ma threadstdio system call classes, na'o le ta'e "./pledge.com -p 'stdio rpath inet thread' curl http://example.com".
O le faʻaogaina o le tautoga e galue i luga o faʻasalalauga Linux uma e amata ile RHEL6 ma e le manaʻomia le aʻa. E le gata i lea, e faʻavae i luga o le faletusi cosmopolitan, ua tuʻuina atu se API mo le faʻatonutonuina o tapulaʻa i le polokalame code i le gagana C, lea e mafai ai, faʻatasi ai ma isi mea, ona faia faʻapipiʻi mo le filifilia faʻatapulaʻaina o avanoa e faʻatatau i nisi o galuega faʻaoga.
O le faʻatinoga e le manaʻomia ni suiga i le fatu - faʻatapulaʻaina o tautoga e faʻaliliuina i tulafono a le SECCOMP BPF ma faʻaogaina e faʻaaoga ai le faʻaogaina o le Linux system call isolation mechanism. Mo se fa'ata'ita'iga, o le tautoga valaau("stdio rpath", 0) o le a liua i se BPF filter static const struct sock_filter kFilter[] = { /* L0*/ BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, syscall, 0, 14 - 1 ), / * L1*/ BPF_STMT(BPF_LD | BPF_W | BPF_ABS, OFF(args[0])), /* L2*/ BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 2, 4 - 3, 0), /* L3* / BPF_JUMP( BPF_JMP | BPF_JEQ | BPF_K, 10, 0, 13 - 4), /* L4*/ BPF_STMT(BPF_LD | BPF_W | BPF_ABS, OFF(args[1])), /* L5*/ BPF_STMT(BPF_ALU | BPF_AND | BPF_K, ~0x80800), /* L6*/ BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 1, 8 - 7, 0), /* L7*/ BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 2, 0, 13 - , /* L8*/ BPF_STMT(BPF_LD | BPF_W | BPF_ABS, OFF(args[8])), /* L2*/ BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 9, 0 - 12, 10), /*L0*/ BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 10, 6 - 12, 11), /*L0*/ BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 11, 17, 0 - 13), /*L11*/ BPF_KPF | SECCOMP_RET_ALLOW), /*L12*/ BPF_STMT(BPF_LD | BPF_W | BPF_ABS, OFF(nr)), /*L13*/ /* isi faamama */ };
puna: opennet.ru