David Uhden Collado <[email protected]> wrote:
> I agree that returning ENOSYS for arbitrary pledge violations can
> break program invariants and introduce attack surface. I am not
> arguing that the "error" promise is safe for arbitrary programs.
It introduces attack surface.
> However, I think this is an argument against "error" and its
> interaction with execpromises, rather than necessarily against
> execpromises itself.
But it introduces attack surface.
> For example, ldd uses:
>
> pledge("stdio rpath exec", "stdio rpath");
>
> It does not use "error". Violations terminate the process instead of
> allowing execution to continue with potentially broken invariants.
ldd does not need this.
> Would it be reasonable to remove or restrict "error" while retaining
> fail-closed execpromises for carefully controlled execution paths?
No.
