NetBSD-Advocacy archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

Re: Competition

> One thing that I somewhat miss is systrace, however.  kauth is nice but
> it's also quite different; it was easy to configure per-application
> profiles with systrace without the need for kernel hacking.  I
> understand that with our limited resources and its problematic pre-SMP
> design it was no longer ideal and couldn't be fixed easily, though.

systrace was removed because it is far too easy for a program
to circumvent the policy, this has probably always been true.
The interface itself could have been used for a system call trace
(like solaris truss), but it isn't a good idea to use it to
enforce security.


David Laight:

Home | Main Index | Thread Index | Old Index