4 ms·

"I'd like to see these security levels built into browsers where the contexts are built around permissions and site trust rather than access to the user store (

by rsync 10y ago

"I'd like to see these security levels built into browsers where the contexts are built around permissions and site trust rather than access to the user store (which is also important)" I want to take it all the way to eleven and 'jail' a gui process (in this case, the web browser - any web browser). It gets its own filesystem root and its own IP BUT I don't have to pay the penalties of firing up a full blown virtual machine. This isn't easy to do in the way that, for instance, jailing a daemon is easy to do ... Further, even if I did have a workable recipe to jail a chrome process (and all of it's children) it would certainly only be for X. Maybe there's some recipe for that in OSX but it would be profoundly different. OSX doesn't even have the 'jail' command (although it does have chroot ...)

d33 10y ago
For a partial solution, have a look at "sandbox -X" (man 8 sandbox).
- db48x 10y ago
  Agreed, although be aware that this is only available when you're using SELinux. By default that's Fedora/Centos/RHEL, not Debian/Ubuntu.
raesene9 10y ago
depending on your OS of choice, desktop containers using something like docker (e.g. https://blog.jessfraz.com/post/docker-containers-on-the-desktop/ https://blog.jessfraz.com/post/docker-containers-on-the-desk...) can achieve it and are a reasonably straightforward (for a certain value of straightforard) option (linux only unfortunately...)
- the_why_of_y 10y ago
  > The images work by mounting the X11 socket into the container! Yippeeeee! Well, yippee, now the application can read all keyboard input from that X11 socket, there goes your "sandbox"... You really need Wayland to get a practical security benefit for GUI applications from containers.