Return to Answer

What is Pledge?

pledge is a system call.

Calling pledge in a program is to promise that the program will only use certain resources.

Another way of saying is to limit the operation of a program to its needs, e.g.,

"I pledge not to use any other ports except port 63"
"I pledge not to use any other system-call except lseek() and fork()"

How does it make a program more secure?

It limits the operation of a program. Example:

• You wrote a program named xyz that only needs the read system-call.
• Then you add pledge to use only read but nothing else.
• Then a malicious user found out that in your program there is a vulnerability by which one can invoke a root shell.
• Exploiting your program to open a root shell will result that the kernel will kill the process with SIGABRT (which cannot be caught/ignored) and generate a log (which you can find with dmesg).

It happens because before executing other codes of your program, it first pledge not to use anything other than read system call. But opening root shell will call several other system-calls which is forbidden because its already promised not to use any other but read.

Where is Pledge?

Its usually in a program. Usage from OpenBSD 6.5 man page:

#include <unistd.h> int pledge(const char *promises, const char *execpromises); 

Example Code: Example code of cat command from cat.c

........ #include <unistd.h> ........ int ch; if (pledge("stdio rpath", NULL) == -1) err(1, "pledge"); while ((ch = getopt(argc, argv, "benstuv")) != -1) .......... 

What is Pledge?

pledge is a system call.

Calling pledge in a program is to promise that the program will only use certain resources.

Another way of saying is to limit the operation of a program to its needs, e.g.,

"I pledge not to open any new sockets"
"I pledge to only write temporary files, and not write other files"

How does it make a program more secure?

It limits the operation of a program. Example:

• You wrote a program named xyz that only needs the read system-call.
• Then you add pledge to use only read but nothing else.
• Then a malicious user found out that in your program there is a vulnerability by which one can invoke a root shell.
• Exploiting your program to open a root shell will result that the kernel will kill the process with SIGABRT (which cannot be caught/ignored) and generate a log (which you can find with dmesg).

It happens because before executing other codes of your program, it first pledge not to use anything other than read system call. But opening root shell will call several other system-calls which is forbidden because its already promised not to use any other but read.

Where is Pledge?

Its usually in a program. Usage from OpenBSD 6.5 man page:

#include <unistd.h> int pledge(const char *promises, const char *execpromises); 

Example Code: Example code of cat command from cat.c

........ #include <unistd.h> ........ int ch; if (pledge("stdio rpath", NULL) == -1) err(1, "pledge"); while ((ch = getopt(argc, argv, "benstuv")) != -1) .......... 

What is Pledge?

pledge is a system call.

Calling pledge in a program is to promise that the program will only use certain resources.

Another way of saying is to limit the operation of a program to its needs, e.g.,

"I pledge not to use any other ports except port 63"
"I pledge not to use any other system-call except lseek() and fork()"

How does it make a program more secure?

It limits the operation of a program. Example:

• You wrote a program named xyz that only needs the read system-call.
• Then you add pledge to use only read but nothing else.
• Then a malicious user found out that in your program there is a vulnerability by which one can invoke a root shell.
• Exploiting your program to open a root shell will result that the kernel will kill the process with SIGABRT (which cannot be caught/ignored) and generate a log (which you can find with dmesg).

It happens because before executing other codes of your program, it first pledge not to use anything other than read system call. But opening root shell will call several other system-calls which is forbidden because its already promised not to use any other but read.

Where is Pledge?

Its usually in a program. Usage:

#include <unistd.h> int pledge(const char *promises, const char *paths[]); 

Example Code: Example code of cat command from cat.c

........ #include <unistd.h> ........ int ch; if (pledge("stdio rpath", NULL) == -1) err(1, "pledge"); while ((ch = getopt(argc, argv, "benstuv")) != -1) .......... 

What is Pledge?

pledge is a system call.

Calling pledge in a program is to promise that the program will only use certain resources.

Another way of saying is to limit the operation of a program to its needs, e.g.,

"I pledge not to use any other ports except port 63"
"I pledge not to use any other system-call except lseek() and fork()"

How does it make a program more secure?

It limits the operation of a program. Example:

• You wrote a program named xyz that only needs the read system-call.
• Then you add pledge to use only read but nothing else.
• Then a malicious user found out that in your program there is a vulnerability by which one can invoke a root shell.
• Exploiting your program to open a root shell will result that the kernel will kill the process with SIGABRT (which cannot be caught/ignored) and generate a log (which you can find with dmesg).

It happens because before executing other codes of your program, it first pledge not to use anything other than read system call. But opening root shell will call several other system-calls which is forbidden because its already promised not to use any other but read.

Where is Pledge?

Its usually in a program. Usage from OpenBSD 6.5 man page:

#include <unistd.h>   int pledge(const char *promises, const char *execpromises); 

Example Code: Example code of cat command from cat.c

........ #include <unistd.h> ........ int ch; if (pledge("stdio rpath", NULL) == -1) err(1, "pledge"); while ((ch = getopt(argc, argv, "benstuv")) != -1) .......... 

What is Pledge?

pledge is a system call.

Calling pledge in a program is to promise that the program will only use certain resources.

Another way of saying is to limit the operation of a program to its needs.

It's kinda like,

"I pledge not to use any other ports except port 63"
"I pledge not to use any other system-call except lseek() and fork()"

How it makes a program secure?

It limits the operation of a program. Example:

• You wrote a program named xyz that only need read system-call.
• Then you add pledge to use only read system call but no other.
• Then a malicious user found that in your programm there is a vulnerability by which he can invoke a root shell.
• But when he exploit your program and try to open root shell the kernel will kill the program with an uncatchable SIGABRT and generate a log (which you can find on dmesg).

It happens because before executing other codes of your program, it first pledge not to use anything other than read system call. But opening root shell will call several other system-calls which is forbidden because its already promised not to use any other but read.

Where is Pledge?

Its usually in a program. Usage:

#include <unistd.h> int pledge(const char *promises, const char *paths[]); 

Example Code: Example code of cat command from cat.c

........ #include <unistd.h> ........ int ch; if (pledge("stdio rpath", NULL) == -1) err(1, "pledge"); while ((ch = getopt(argc, argv, "benstuv")) != -1) .......... 

What is Pledge?

pledge is a system call.

Calling pledge in a program is to promise that the program will only use certain resources.

Another way of saying is to limit the operation of a program to its needs, e.g.,

"I pledge not to use any other ports except port 63"
"I pledge not to use any other system-call except lseek() and fork()"

How does it make a program more secure?

It limits the operation of a program. Example:

• You wrote a program named xyz that only needs the read system-call.
• Then you add pledge to use only read but nothing else.
• Then a malicious user found out that in your program there is a vulnerability by which one can invoke a root shell.
• Exploiting your program to open a root shell will result that the kernel will kill the process with SIGABRT (which cannot be caught/ignored) and generate a log (which you can find with dmesg).

It happens because before executing other codes of your program, it first pledge not to use anything other than read system call. But opening root shell will call several other system-calls which is forbidden because its already promised not to use any other but read.

Where is Pledge?

Its usually in a program. Usage:

#include <unistd.h> int pledge(const char *promises, const char *paths[]); 

Example Code: Example code of cat command from cat.c

........ #include <unistd.h> ........ int ch; if (pledge("stdio rpath", NULL) == -1) err(1, "pledge"); while ((ch = getopt(argc, argv, "benstuv")) != -1) ..........