Exile.h Alternatives

Similar projects and alternatives to exile.h based on common topics and language

cosmopolitan

201 15,067 9.8 C exile.h VS cosmopolitan

build-once run-anywhere c library
firejail

139 5,442 9.7 C exile.h VS firejail

Linux namespaces and seccomp-bpf sandbox
InfluxDB

www.influxdata.com sponsored

Power Real-Time Data Analytics at Scale. Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality.
libseccomp

3 771 4.6 C exile.h VS libseccomp

The main libseccomp repository
misc

3 6 1.1 Roff exile.h VS misc

Discontinued miscellaneous scripts and small programs (by 62726164)
capsicum-linux

1 204 10.0 C exile.h VS capsicum-linux

Discontinued Linux kernel with Capsicum support
seccomp-scopes

1 9 10.0 C exile.h VS seccomp-scopes

Make Linux computing safe
cbsd

6 625 8.7 C exile.h VS cbsd

Yet one more wrapper around jail, bhyve, QEMU and XEN
WorkOS

workos.com sponsored

The modern identity platform for B2B SaaS. The APIs are flexible and easy-to-use, supporting authentication, user identity, and complex enterprise features like SSO and SCIM provisioning.

NOTE: The number of mentions on this list indicates mentions on common posts plus user suggested alternatives. Hence, a higher number means a better exile.h alternative or higher similarity.

Suggest an alternative to exile.h

exile.h reviews and mentions

Posts with mentions or reviews of exile.h. We have used some of these posts to build our list of alternatives and similar projects. The last one was on 2022-07-14.

Show HN: Porting OpenBSD Pledge() to Linux
10 projects | news.ycombinator.com | 14 Jul 2022

Great work!
>.. So how do we get it that simple on Linux? I believe the answer is to find someone with enough free time to figure out how to use SECCOMP BPF to implement pledge.
> There's been a few devs in the past who've tried this. I'm not going to name names, because most of these projects were never completed.
I guess I am also one of those. I am giving it a shot with my WIP sandboxing library, which aims at making sandboxing easier for applications in general: https://github.com/quitesimpleorg/exile.h. It also aims to fix the "file system blind spot" mentioned in the article, by using Landlock and Namespaces/chroot.
Though I am calling my attempt "vows" instead of "pledge" to avoid misunderstandings. At the the end of the day, pledge() cannot be pledge() on Linux, due to limitations which the article also mentions.
Nevertheless, as has already been mentioned in this thread, as all attempts, mine also suffers from the fact that one has to keep up constantly with kernel releases and all software must recompiled from time to time against new library releases. This is a suboptimal situation. Secondly, there systems calls with currently cannot be filtered with seccomp BPF, such as openat2() and clone3() and so on.
Therefore, at this time you cannot have pledge() on Linux properly. So I am putting it on hold until deep argument inspection lands.
Overall, my experience led me to believe in order to have true, partical pledge() on Linux, it must be implemented in the kernel ultimately.

Stats

Basic exile.h repo stats

Mentions

Stars

Activity

0.0

Last Commit

over 1 year ago

The primary programming language of exile.h is C.