6 ms·

Another huge issue is that user-level programs can access all everything in the user's home directory which is where all valuable data resides. There is no reas

by gizmo 11y ago

Another huge issue is that user-level programs can access all everything in the user's home directory which is where all valuable data resides. There is no reason why a tetris game should get access to all your financial documents, but that's how it works today. A single malicious user-level program can destroy everything of value on your computer and no elevated permissions are required. In contrast to iOS where all app data is siloed off, exactly as it should be.

chris_st 11y ago
You might be interested in the SubUser[1] project, which does exactly this application siloing for Linux. [1] http://subuser.org http://subuser.org
- gizmo 11y ago
  I like what they're doing, but applications have to be written from the ground up knowing that they live in a sandbox, so they can ask for the appropriate permissions in the appropriate places explaining why the extra permissions are needed. Otherwise the user experience is going to be pretty bad. Security doesn't work as an add-on.
  - heavenlyhash 11y ago
    Nah, there's a lot of room for easy adoption. For example, for a text editor like vim, here's a completely reasonable lockdown: - see none of my filesystem... except `cwd` I launched you in - you get a homedir that's persistent for this application - (incidentally, whatever libraries you need are there; network namespaces dropped, clean env vars, clean pid space, etc etc etc.) The things on this list involve essentially Nothing Special and no changes to the program, and at the same time manages to radically reduce the surface area a malicious program can mess with on my computer. Even if, say, a malicious version of vim somehow made it in $distro's package tree and was signed: this still makes me... well, pretty safe. The scope of damage is confined to... exactly what I just laid out on those two bullet points. And subuser's configuration does an excellent job of exposing exactly those kinds of behaviors to you with very minimum amounts of fuss. (A json file with `{"access-working-directory": true, "stateful-home": true}` is all you have to say to subuser to set up an application to get... well, hey, if these aren't self-documenting names, I don't know what is.)
ris 11y ago
"In contrast to iOS where all app data is siloed off, exactly as it should be." Which is also why trying to do anything productive on a smartphone is such an uphill battle. Arbitrary programs not being able to exchange arbitrary files is totally crippling for any use-cases that go off the rails of what one single app wants to let you do.
- gizmo 11y ago
  Sharing data and interopability between applications is a hard problem, but Apple is on the right track. In any case, starting out with something with sound fundamentals and then improving usability is a much better approach than starting with something that is fundamentally broken and adding kludges to make it more secure.
- JustSomeNobody 11y ago
  This is my biggest pet peeve with iOS. That and the way background services act. Why can't I have an app that syncs my photos to my server run at night without the location hack? Ugh.
- b1340276 11y ago
  That may be a roadblock but the primary reason why smartphones are relatively unproductive is because a touch only interface has the disadvantage that you can only interact with things that are visible on the screen. When your screen is less than 7" big and 30% of that space is wasted by a virtual keyboard then the only way to design a UI for a smartphone is to have as few interactions as possible, otherwise we end up having to constantly scroll up and down. The end result is that a lot of apps are hiding core functionality behind the hamburger icon.
  - LoSboccacc 11y ago
    copy paste already works wonder to share pictures and the like between multiple programs on iOS at least, one can easily extend the pattern in a desktop environment and even add more entry point as long as they are user initiated, kind of like you can access the clipboard in browser only if it's on the stack of a user initiated event.
benwaffle 11y ago
xdg-app is currently being developed by gnome and it does sandboxing like not giving Tetris access to your file system https://wiki.gnome.org/Projects/SandboxedApps https://wiki.gnome.org/Projects/SandboxedApps
mtgx 11y ago
I think Subgraph has some application-level sandboxing, and of course there's Qubes (from the author of this article), which can be used for "risky" apps, too.
zanny 11y ago
This has existed for over a decade in the form of mandatory access control (MAC). Any distro worth talking about has been shipping a MAC solution (Apparmor or SELinux mainly, even though I'd argue grsec / pax is way better) for years, the problem is more that I do not believe any of them use default-deny policies, because there is no mechanism to ask the user for permission for unknown programs or programs trying to act outside their allocated access controls. But for anything you install from the main repos, it will almost always have an apparmor / selinux profile installed along with it to prevent this kind of arbitrary filesystem access.

by gizmo 11y ago

chris_st 11y ago

You might be interested in the SubUser[1] project, which does exactly this application siloing for Linux. [1] http://subuser.org http://subuser.org

gizmo 11y ago
I like what they're doing, but applications have to be written from the ground up knowing that they live in a sandbox, so they can ask for the appropriate permissions in the appropriate places explaining why the extra permissions are needed. Otherwise the user experience is going to be pretty bad. Security doesn't work as an add-on.
- heavenlyhash 11y ago
  Nah, there's a lot of room for easy adoption. For example, for a text editor like vim, here's a completely reasonable lockdown: - see none of my filesystem... except `cwd` I launched you in - you get a homedir that's persistent for this application - (incidentally, whatever libraries you need are there; network namespaces dropped, clean env vars, clean pid space, etc etc etc.) The things on this list involve essentially Nothing Special and no changes to the program, and at the same time manages to radically reduce the surface area a malicious program can mess with on my computer. Even if, say, a malicious version of vim somehow made it in $distro's package tree and was signed: this still makes me... well, pretty safe. The scope of damage is confined to... exactly what I just laid out on those two bullet points. And subuser's configuration does an excellent job of exposing exactly those kinds of behaviors to you with very minimum amounts of fuss. (A json file with `{"access-working-directory": true, "stateful-home": true}` is all you have to say to subuser to set up an application to get... well, hey, if these aren't self-documenting names, I don't know what is.)

ris 11y ago

"In contrast to iOS where all app data is siloed off, exactly as it should be." Which is also why trying to do anything productive on a smartphone is such an uphill battle. Arbitrary programs not being able to exchange arbitrary files is totally crippling for any use-cases that go off the rails of what one single app wants to let you do.

gizmo 11y ago
Sharing data and interopability between applications is a hard problem, but Apple is on the right track. In any case, starting out with something with sound fundamentals and then improving usability is a much better approach than starting with something that is fundamentally broken and adding kludges to make it more secure.
JustSomeNobody 11y ago
This is my biggest pet peeve with iOS. That and the way background services act. Why can't I have an app that syncs my photos to my server run at night without the location hack? Ugh.
b1340276 11y ago
That may be a roadblock but the primary reason why smartphones are relatively unproductive is because a touch only interface has the disadvantage that you can only interact with things that are visible on the screen. When your screen is less than 7" big and 30% of that space is wasted by a virtual keyboard then the only way to design a UI for a smartphone is to have as few interactions as possible, otherwise we end up having to constantly scroll up and down. The end result is that a lot of apps are hiding core functionality behind the hamburger icon.
- LoSboccacc 11y ago
  copy paste already works wonder to share pictures and the like between multiple programs on iOS at least, one can easily extend the pattern in a desktop environment and even add more entry point as long as they are user initiated, kind of like you can access the clipboard in browser only if it's on the stack of a user initiated event.

benwaffle 11y ago

xdg-app is currently being developed by gnome and it does sandboxing like not giving Tetris access to your file system https://wiki.gnome.org/Projects/SandboxedApps https://wiki.gnome.org/Projects/SandboxedApps

mtgx 11y ago

I think Subgraph has some application-level sandboxing, and of course there's Qubes (from the author of this article), which can be used for "risky" apps, too.

zanny 11y ago

This has existed for over a decade in the form of mandatory access control (MAC). Any distro worth talking about has been shipping a MAC solution (Apparmor or SELinux mainly, even though I'd argue grsec / pax is way better) for years, the problem is more that I do not believe any of them use default-deny policies, because there is no mechanism to ask the user for permission for unknown programs or programs trying to act outside their allocated access controls. But for anything you install from the main repos, it will almost always have an apparmor / selinux profile installed along with it to prevent this kind of arbitrary filesystem access.