3 ms·

Something like this is built into Android and iPhone. As all major desktop OSes are only good in protecting one user from another mobile OSes run every applicat

Something like this is built into Android and iPhone. As all major desktop OSes are only good in protecting one user from another mobile OSes run every application under its own user account. So vulnerability in an image viewer would not give an attacker access to other apps' data. But the system is not perfect, for example the kernel can still be attacked (and as we know a lot of vulnerabilities were found in Linux in recent years) and on Android the files on sdcard partition are not protected at all. But desktop OSes don't do anything at all to protect the user. They allow the user to run a program by just clicking a link in email or web browser and this program has full access to all their data as does the PDF viewer or Java plugin in a browser. The desktop operating systems still use security models from mainframe era.

ndesaulniers 10y ago
> So vulnerability in an image viewer would not give an attacker access to other apps' data. By having separate user's per app, apps can't read each others' files by default. If one app has a vulnerability that can be used to acquire root, that app can read all files after disabling SELinux.
- codedokode 10y ago
  > If one app has a vulnerability that can be used to acquire root To get root privileges you need to attack the kernel (or the application that has those privileges). Having a bug in an image viewer is not enough. You can try to make obtaining root privileges more complicated only by reducing the attack surface with restricting system calls each application is allowed to make or with redesigning the kernel so that less code is executed in ring 0 (microkernel architecture). But recent vulnerabilities like Dirty COW or rowhammer could work even in this case.