3 ms·

I've never heard of CLONE_NEWUSER before, it looks interesting. I don't think it's in FreeBSD. My concern is that you can clearly browse and save files, so the

by sega01 11y ago

I've never heard of CLONE_NEWUSER before, it looks interesting. I don't think it's in FreeBSD. My concern is that you can clearly browse and save files, so there is something that has access. Maybe it's much more secure than I thought, but I tend to be really skeptical towards programs of such length being perfectly secure.

geofft 11y ago
CLONE_NEWUSER / user namespaces is Linux-specific, yes. (Though see my other comment.) I believe the Chromium sandbox mostly applies to things like renderers, where you can just hand it a buffer and a bunch of inputs and it'll effectively contain things like HTML parser bugs or libpng buffer overflows. I'm not totally sure if browsing itself is sandboxed.