|
|
|
|
|
|
by Spivak
370 days ago
|
|
|
Out of scope—pledge is designed to allow developers to sandbox their own programs to deal with compromises. If someone finds a bug with your program that tricks it into opening an arbitrary file then pledge just saved you. These sandboxing tools aren't designed to make it safe to run arbitrary untrusted code. If you want that then you're looking at a VM- either a full VM like firecracker or a software VM like V8. |
|
|