Pledge Symfony Routing Laravel Package

Product Decisions This Supports

• Security Hardening for OpenBSD Deployments: Enables fine-grained process restrictions (pledge/unveil) directly in Symfony route definitions, aligning with OpenBSD’s security-first philosophy. Critical for compliance-sensitive applications (e.g., financial, healthcare).
• Build vs. Buy: Avoids custom middleware development for OpenBSD-specific security policies, reducing technical debt.
• Roadmap for Multi-OS Security: Foundation for future cross-platform security attributes (e.g., Linux seccomp, macOS sandboxing) if extended.
• Use Cases:
  • Microservices: Isolate route handlers with strict permissions (e.g., read-only logs, write-only cache).
  • Legacy System Integration: Secure APIs connecting to external systems (e.g., databases via inet pledge).
  • Compliance: Meet OpenBSD-specific security audits (e.g., "no unnecessary file access").

When to Consider This Package

• Adopt if:

  • Running Symfony on OpenBSD and prioritizing mandatory access control (pledge/unveil).
  • Deploying high-security applications where process isolation is critical (e.g., payment processing).
  • Already using PHP-FPM with pm.max_requests = 1 (required for pledge persistence).
  • Willing to trade flexibility for security (e.g., explicit unveil paths limit dynamic file access).

• Look Elsewhere if:

  • Not on OpenBSD: Pledge/unveil are OpenBSD-specific; alternatives like Linux seccomp or general PHP security headers are needed.
  • Dynamic File Paths: Require runtime path resolution (pledge/unveil needs compile-time definitions).
  • Performance Overhead: Pledge restrictions may impact debugging or development workflows.
  • Multi-OS Deployments: Seek cross-platform solutions (e.g., Symfony’s built-in security components).

How to Pitch It (Stakeholders)

Executives: "This package lets us enforce OpenBSD’s pledge/unveil security model directly in Symfony routes—no custom code. For [compliance/security-critical use case], it’s a turnkey way to harden our [application] against file system leaks or unauthorized network access. Minimal dev effort, maximal security audit confidence."

Engineering: "Symfony + OpenBSD? Now you can annotate controllers with #[Pledge] and #[Unveil] to restrict process capabilities per route. Example: Lock down a /payments endpoint to only read /config and write /logs. Requires PHP-FPM tweaks (pm.max_requests=1) but eliminates manual middleware for OpenBSD security. Docs are sparse, but the pecl-pledge project backs the core logic."

Security Team: "This bridges Symfony’s routing with OpenBSD’s pledge/unveil, giving us granular control over what each route can do—file access, network, etc.—without runtime overhead. Critical for [specific compliance goal], and it’s maintainable since it’s tied to route definitions."