kern_mib: Allow kern.hostname in Capsicum capability sandbox

[cem]

Summary

Needed by write(1), others. I don't see a good reason to disallow readonly
access.

[ed]

Well... I don't know about this. One of the ideas of Capsicum is that it's (in theory) strong enough to run things that you completely don't trust, that are entirely isolated from global system state. At least, that's what I'm aiming at for CloudABI.

Question: can't we cache this info in userspace before calling cap_enter()?

[cem]

In D8000#165482, @ed wrote:

Well... I don't know about this. One of the ideas of Capsicum is that it's (in theory) strong enough to run things that you completely don't trust, that are entirely isolated from global system state. At least, that's what I'm aiming at for CloudABI.

I don't know how much hostname matters.

Question: can't we cache this info in userspace before calling cap_enter()?

We can do a lot of things ahead of entering cap mode, but that decreases how useful it is — both in the amount of code that runs outside of it, and in how much rewriting existing programs need to run in capability mode. :-)

[ed]

(Review 8000! Only 192 until a big round-number milestone!)

In D8000#165594, @cem wrote:

In D8000#165482, @ed wrote:

Well... I don't know about this. One of the ideas of Capsicum is that it's (in theory) strong enough to run things that you completely don't trust, that are entirely isolated from global system state. At least, that's what I'm aiming at for CloudABI.

I don't know how much hostname matters.

Me neither, so I'm hereby delegating this to rwatson@/emaste@ ;-)

[rwatson]

I'm fine with exposing the hostname here -- the goal of Capsicum has always been to be pragmatic about getting software running where it doesn't violate isolation properties. You could argue that this is an information leak and/or might cause problems for deterministic replay-style applications of Capsicum -- but I'd rather we had more code working in a sandboxing. :-)

[jonathan]

In D8000#165698, @rwatson wrote:

I'm fine with exposing the hostname here -- the goal of Capsicum has always been to be pragmatic about getting software running where it doesn't violate isolation properties. You could argue that this is an information leak and/or might cause problems for deterministic replay-style applications of Capsicum -- but I'd rather we had more code working in a sandboxing. :-)

I agree. If we wanted to be serious about information leakage, we'd have had to block lots of other fairly mundane sysctls too. That would be neat in a purist sense, but Capsicum's selling point has always been that we aren't a purist capability system.

[cem]

@rwatson , @jonathan : @allanjude wonders abut the other sysctls in this block in D8015. I think domainname is probably fine. I don't know what hostuuid is, though.

[cem]

Obviated by D8015.