How many times do you see a bug investigation and it's determined when the bug was introduced?
Do you ever look at the diff that introduced it to understand what was going on in the project at the time? Often, it's in service to a new feature. Sometimes the original change is questionable when you consider you traded it for a severe bug.
Yes necessarily. Always. You need to invoke Nasa and fighter jets to find anything coming close, and they only manage to do any better by massive brute overkill in standards & procedures.
Linux is a much larger project receiving changes to tons of systems from lots of different sources. The combined behaviour of those things working together is massively harder to understand and test.
Copyfail being introduced by an optimization made to some random crypto module is a good example of this.
The others and I, working on GNU coreutils, frequently use 'yes' to generate a bunch of garbage input for testing programs. It is nice that it can do so quickly.
Just as another point of comparison, FreeBSD's version seems somewhere in-between. It also enables a Capsicum sandbox before processing any data, akin to what the OpenBSD version does with pledge.
Difference is that capsicum is after the fact and mostly about file descriptors. You need to open them in advance and _then_ call capsicum. But it does nothing about syscalls.
Capsicum is really nice if you plan ahead, but pledge/unveil is easy to drop into any existing code base.
Your blog isn't loading at the moment, so I'm not entirely sure what you mean here, but...
> capsicum is after the fact
After the fact in what sense? The program enters capability mode before touching any arguments or doing I/O. You have to set things up before enter capability mode because you can't escape out of it afterwards.
> it does nothing about syscalls
It does quite a lot about syscalls, in that it blocks or limits most of them. As the man page says: "Access to system calls in capability mode is restricted: some system calls requiring global namespace access are unavailable, while others are constrained."
In capability mode, you can use specific syscalls that operate on file descriptors, which limits the program to the specific capabilities it has been granted, e.g. pdkill(2) which is like kill(2) except you can only signal processes for which you have a process descriptor.
Seems to be the case.
How many times do you see a bug investigation and it's determined when the bug was introduced?
Do you ever look at the diff that introduced it to understand what was going on in the project at the time? Often, it's in service to a new feature. Sometimes the original change is questionable when you consider you traded it for a severe bug.