mobile-shell / mobile-shell/mosh
Implement privilege revocation in common OSes
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 14.5k
- Forks
- 865
- PR merge metrics
- No merged PRs in 30d
Description
I've done a sample sandboxing implementation with OpenBSD's pledge(). This was really simple to do and it illustrates what the cut points for dropping privileges are, but I'd be surprised if it benefits as much as 5% of Mosh's user base. Doing something for Linux, macOS, and FreeBSD would probably cover 80% of our users.
Having seen https://github.com/kristapsdz/acme-client-portable/blob/master/Linux-seccomp.md, which describes pain with whitelisting syscalls, I think the best approach for Linux might be to blacklist syscalls that would enable attackers to escape Mosh's needs; that list might start with open(), fork(), exec(), socket() except for UDP.
There's some crossover between this and #854 and any other containerization/app-packaging that people might be interested in.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading the existing OpenBSD pledge sandbox implementation, then review issue #854 and the referenced Linux seccomp notes. Clarify the privilege-revocation design for Linux, macOS, and FreeBSD before implementation; done means agreed support for the target operating systems with verification that Mosh still works.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp, linux, macos
- Domain
- operating-systems, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 20/100