6 ms·

I get that this is about the Mac apps, but doesn't this apply to any general OS? On Windows this is trivial, on any Linux distro using X11 too.

bitwize 9y ago
You can trivially sandbox X11 apps by running them in a nested X server.
- quotheth 9y ago
  How many apps do this?
  - pdkl95 9y ago
    I, the user, do that. It's not the app's responsibility.
    - quotheth 9y ago
      Great, I'm sure everyone else feels safe knowing you manually sandbox your apps.
  - wander_homer 9y ago
    If you trust an application so far as to properly limit itself in what it can do by requesting a sandboxed environment so you don't have to type a few additional letters you might just as well run it without a sandbox. Hey kind stranger who is supposed to do the garden while I go shopping, I really don't trust you. So to be sure you only do the garden and nothing else, here are the keys to my house, please ensure that every door and window is locked. Thanks. The only other entity who could set it up for you, so every application automatically launches in a sandboxed environment, is the distributor, but then again it's your responsibility to chose a distribution that does that. If you want security you have to do something about it at one point or another.
    - quotheth 9y ago
      I think this is the wrong attitude. No one is better suited to implement a sandbox than the developer of the application. The fact that most developers are not trained to do so is just a reflection of our field's terrible progress re: education devs on secure app dev. Leaving this to the user leaves the vast majority of users unsafe. This is an unacceptable state.
      - wander_homer 9y ago
        Why should an application developer implement a sandbox? That's a huge waste of time and it's much more efficient if the operating system or the user enforces it instead by using existing sandboxing technologies like firejail. It is also untrustworthy and insecure, since after all you don't trust the application. If an application is responsible for sandboxing itself it can also choose not to sandbox itself properly if it wants to do harm. There is no way around you either taking care of that yourself or you choosing an operating system that enforces it for you, like Qubes OS.
        quotheth 9y ago
        > Why should an application developer implement a sandbox? Because they are the ones who understand the necessary capabilities of their program and the ones who have access to the source code... > That's a huge waste of time and it's much more efficient if the operating system or the user enforces it instead by using existing sandboxing technologies like firejail. Actually it's a far better sandbox when built into the program. And it doesn't leave users relying on installing arcane operating systems or becoming technically savvy. > It is also untrustworthy and insecure, since after all you don't trust the application. No, trusting the application is implicit since it's installed by the user. The sandbox exists to protect against a compromised application.
- geofft 9y ago
  And a separate user account, otherwise they can just connect to the original X server. (And on almost all existent Linux systems, either running as a separate user isn't trivial or the sandboxing process has root.)
  - pritambaral 9y ago
    Is a separate user account necessary if the Xauthority cookie is shadowed in the sandbox? I think firejail's nested X server setup works this way, without a separate user account.
    - geofft 9y ago
      What prevents you from reading the Xauthority cookie out of disk / an existing process's environment / out of an existing process's memory / etc.? You need a sandbox to prevent it fro doing these things, which is certainly doable, but much harder than just opening a new X server. (On a system without Yama enabled, you can also ptrace any other process running as the same user and run code as it, e.g., using gdb, but lots of desktop-focused Linux distros enable Yama to close this particular approach.)
      - pritambaral 9y ago
        > What prevents you from reading the Xauthority cookie out of disk / an existing process's environment / out of an existing process's memory / etc.? The sandbox does. > You need a sandbox to prevent it fro doing these things, which is certainly doable, but much harder than just opening a new X server. Of course. I never said simply running a new X server is sufficient. All I asked is if the sandbox needed to run the program in a separate user account.
GirlsCanCode 9y ago
Really? How can you do this from a Sandboxed app in Windows 10? I presume you're a paid Apple astroturfer
b4lancesh33t 9y ago
I think what's concerning is that advertising that an app is in a sandbox suggests to those out of the know that they can use it safely. They expect that the integrity and privacy of their information will be preserved. That expectation does not exist with ordinary win32 or Linux programs. Are windows store apps sandboxed? If so, is it trivially easy to do this with those? Or is it just win32?
- jchw 9y ago
  True UWP apps are sandboxed and probably can't do this. They have access to a limited version of the Win32 API, I believe.
Bitcoin_McPonzi 9y ago
Windows 10 closed this hole.
- camhart 9y ago
  How so? In java I can access all screens without requesting a permission.
  - anonymfus 9y ago
    In store applications without full trust permissions you can not.
    - pritambaral 9y ago
      Store applications are not the only applications on Windows 10. Closing holes in store applications alone does not close all the holes.
      - djsumdog 9y ago
        This article is addressing sandboxed applications. Regular applications, yes, you can pretty much do whatever in userspace in Win/Mac/X11. If you're going to create a new sandbox environment for applications (Windows Store/MacOS store) in today's world, it really needs to be locked down with explicit permissions for each type of I/O access.
  - chungy 9y ago
    Windows NT (way back to its original 3.1 release) always had the idea of multiple independent desktops where applications can't cross-interact. If you use runas to run GUI applications under different user contexts, you might notice that some things like drag-and-drop and the clipboard don't work, and also screen recorders won't work ... Most users never use this functionality normally, but you might notice sometimes if you do "Run As Administrator" and the applications don't quite integrate with non-admin apps.
bitL 9y ago
X11 is way worse; any app can subscribe to events of any other app, making keyloggers and other nastyware a piece of cake.
- pdkl95 9y ago
  > any app can subscribe to events of any other app Yes, that's a feature I have used many times in the past. If you want to sandbox an app, run it through a nested X server.
  - noway421 9y ago
    AFAIK you can't get any hardware acceleration that way.
    - badsectoracula 9y ago
      Depends on the X server, i think Xnest uses just a dumb framebuffer but i think Xephyr can use acceleration just fine.
  - TeMPOraL 9y ago
    Indeed. And for Windows, more than once I wrote stuff that captures or injects keystrokes globally. Being able to do this is a feature that lets you solve problems by making things more interoperable.
- globuous 9y ago
  Wow, i have a lot to learn.... Do you know if these sort of things are still possible on wayland ? What about a Flatpak app on Wayland, does that help ? Because I think I've read somewhere that Flatpak apps on X11 was this way, implying that with Wayland it wasn't. I wish i had more time to dive into this sort of stuff... Flatpak does aggressively isolate apps from the OS though: http://docs.flatpak.org/en/latest/working-with-the-sandbox.html http://docs.flatpak.org/en/latest/working-with-the-sandbox.h...
  - Jasper_ 9y ago
kibwen 9y ago
Just goes to show that not all sandboxes are created equal (though I don't think I've ever even used a properly sandboxed Windows or Linux app, so those OSes don't get any points anyway). For example, reading other tabs or processes out of the web browser sandbox isn't possible short of exploits like Spectre and Meltdown, and even seeing something like the history of visited links requires cleverly tricking the user (and coarse guesswork) e.g. https://tinsnail.neocities.org/ https://tinsnail.neocities.org/ and http://lcamtuf.coredump.cx/yahh/ http://lcamtuf.coredump.cx/yahh/ . I imagine the behavior in the OP is impossible on both Android and iOS too?
- abecedarius 9y ago
  There was a pre-Spectre proof of concept of a program telling what tabs you have open in your web browser: https://github.com/defuse/flush-reload-attacks https://github.com/defuse/flush-reload-attacks This was a program rather than another webpage, and I haven't bothered to read how it worked beyond the general idea of exploiting a cache side-channel. I expect the bit-rate is low compared to Spectre/Meltdown. But it made me leery of confidentiality in current systems.
  - yzmtf2008 9y ago
    I think you have the idea of sandbox (or at least the idea of sandbox in the context of a web browser) backwards: it means an application (webpage) running inside the sandbox cannot access resources not granted. This side channel access does not run inside a sandbox at all.
    - abecedarius 9y ago
      If you don't consider an OS process a sandbox at all, why are even talking about security here?
      - yzmtf2008 9y ago
        That’s not the point of GP though? The whole premise of virtualization is that an OS process is not a perfect sandbox. There’s a hierarchy of sandboxes. Protecting other processes from accessing something inside the sandbox is not the job of a browser sandbox. This actually just goes to show the GP’s point: not all sandboxes are created equal.
emersion 9y ago
On Linux, Wayland fixes this (+ allows for other security features, e.g. to protect the clipboard).

bitwize 9y ago

You can trivially sandbox X11 apps by running them in a nested X server.

quotheth 9y ago
How many apps do this?
- pdkl95 9y ago
  I, the user, do that. It's not the app's responsibility.
  - quotheth 9y ago
    Great, I'm sure everyone else feels safe knowing you manually sandbox your apps.
- wander_homer 9y ago
  If you trust an application so far as to properly limit itself in what it can do by requesting a sandboxed environment so you don't have to type a few additional letters you might just as well run it without a sandbox. Hey kind stranger who is supposed to do the garden while I go shopping, I really don't trust you. So to be sure you only do the garden and nothing else, here are the keys to my house, please ensure that every door and window is locked. Thanks. The only other entity who could set it up for you, so every application automatically launches in a sandboxed environment, is the distributor, but then again it's your responsibility to chose a distribution that does that. If you want security you have to do something about it at one point or another.
  - quotheth 9y ago
    I think this is the wrong attitude. No one is better suited to implement a sandbox than the developer of the application. The fact that most developers are not trained to do so is just a reflection of our field's terrible progress re: education devs on secure app dev. Leaving this to the user leaves the vast majority of users unsafe. This is an unacceptable state.
    - wander_homer 9y ago
      Why should an application developer implement a sandbox? That's a huge waste of time and it's much more efficient if the operating system or the user enforces it instead by using existing sandboxing technologies like firejail. It is also untrustworthy and insecure, since after all you don't trust the application. If an application is responsible for sandboxing itself it can also choose not to sandbox itself properly if it wants to do harm. There is no way around you either taking care of that yourself or you choosing an operating system that enforces it for you, like Qubes OS.
      - quotheth 9y ago
        > Why should an application developer implement a sandbox? Because they are the ones who understand the necessary capabilities of their program and the ones who have access to the source code... > That's a huge waste of time and it's much more efficient if the operating system or the user enforces it instead by using existing sandboxing technologies like firejail. Actually it's a far better sandbox when built into the program. And it doesn't leave users relying on installing arcane operating systems or becoming technically savvy. > It is also untrustworthy and insecure, since after all you don't trust the application. No, trusting the application is implicit since it's installed by the user. The sandbox exists to protect against a compromised application.
geofft 9y ago
And a separate user account, otherwise they can just connect to the original X server. (And on almost all existent Linux systems, either running as a separate user isn't trivial or the sandboxing process has root.)
- pritambaral 9y ago
  Is a separate user account necessary if the Xauthority cookie is shadowed in the sandbox? I think firejail's nested X server setup works this way, without a separate user account.
  - geofft 9y ago
    What prevents you from reading the Xauthority cookie out of disk / an existing process's environment / out of an existing process's memory / etc.? You need a sandbox to prevent it fro doing these things, which is certainly doable, but much harder than just opening a new X server. (On a system without Yama enabled, you can also ptrace any other process running as the same user and run code as it, e.g., using gdb, but lots of desktop-focused Linux distros enable Yama to close this particular approach.)
    - pritambaral 9y ago
      > What prevents you from reading the Xauthority cookie out of disk / an existing process's environment / out of an existing process's memory / etc.? The sandbox does. > You need a sandbox to prevent it fro doing these things, which is certainly doable, but much harder than just opening a new X server. Of course. I never said simply running a new X server is sufficient. All I asked is if the sandbox needed to run the program in a separate user account.

GirlsCanCode 9y ago

Really? How can you do this from a Sandboxed app in Windows 10? I presume you're a paid Apple astroturfer

b4lancesh33t 9y ago

I think what's concerning is that advertising that an app is in a sandbox suggests to those out of the know that they can use it safely. They expect that the integrity and privacy of their information will be preserved. That expectation does not exist with ordinary win32 or Linux programs. Are windows store apps sandboxed? If so, is it trivially easy to do this with those? Or is it just win32?

jchw 9y ago
True UWP apps are sandboxed and probably can't do this. They have access to a limited version of the Win32 API, I believe.

Bitcoin_McPonzi 9y ago

Windows 10 closed this hole.

camhart 9y ago
How so? In java I can access all screens without requesting a permission.
- anonymfus 9y ago
  In store applications without full trust permissions you can not.
  - pritambaral 9y ago
    Store applications are not the only applications on Windows 10. Closing holes in store applications alone does not close all the holes.
    - djsumdog 9y ago
      This article is addressing sandboxed applications. Regular applications, yes, you can pretty much do whatever in userspace in Win/Mac/X11. If you're going to create a new sandbox environment for applications (Windows Store/MacOS store) in today's world, it really needs to be locked down with explicit permissions for each type of I/O access.
- chungy 9y ago
  Windows NT (way back to its original 3.1 release) always had the idea of multiple independent desktops where applications can't cross-interact. If you use runas to run GUI applications under different user contexts, you might notice that some things like drag-and-drop and the clipboard don't work, and also screen recorders won't work ... Most users never use this functionality normally, but you might notice sometimes if you do "Run As Administrator" and the applications don't quite integrate with non-admin apps.

bitL 9y ago

X11 is way worse; any app can subscribe to events of any other app, making keyloggers and other nastyware a piece of cake.

pdkl95 9y ago
> any app can subscribe to events of any other app Yes, that's a feature I have used many times in the past. If you want to sandbox an app, run it through a nested X server.
- noway421 9y ago
  AFAIK you can't get any hardware acceleration that way.
  - badsectoracula 9y ago
    Depends on the X server, i think Xnest uses just a dumb framebuffer but i think Xephyr can use acceleration just fine.
- TeMPOraL 9y ago
  Indeed. And for Windows, more than once I wrote stuff that captures or injects keystrokes globally. Being able to do this is a feature that lets you solve problems by making things more interoperable.
globuous 9y ago
Wow, i have a lot to learn.... Do you know if these sort of things are still possible on wayland ? What about a Flatpak app on Wayland, does that help ? Because I think I've read somewhere that Flatpak apps on X11 was this way, implying that with Wayland it wasn't. I wish i had more time to dive into this sort of stuff... Flatpak does aggressively isolate apps from the OS though: http://docs.flatpak.org/en/latest/working-with-the-sandbox.html http://docs.flatpak.org/en/latest/working-with-the-sandbox.h...
- Jasper_ 9y ago

kibwen 9y ago

Just goes to show that not all sandboxes are created equal (though I don't think I've ever even used a properly sandboxed Windows or Linux app, so those OSes don't get any points anyway). For example, reading other tabs or processes out of the web browser sandbox isn't possible short of exploits like Spectre and Meltdown, and even seeing something like the history of visited links requires cleverly tricking the user (and coarse guesswork) e.g. https://tinsnail.neocities.org/ https://tinsnail.neocities.org/ and http://lcamtuf.coredump.cx/yahh/ http://lcamtuf.coredump.cx/yahh/ . I imagine the behavior in the OP is impossible on both Android and iOS too?

abecedarius 9y ago
There was a pre-Spectre proof of concept of a program telling what tabs you have open in your web browser: https://github.com/defuse/flush-reload-attacks https://github.com/defuse/flush-reload-attacks This was a program rather than another webpage, and I haven't bothered to read how it worked beyond the general idea of exploiting a cache side-channel. I expect the bit-rate is low compared to Spectre/Meltdown. But it made me leery of confidentiality in current systems.
- yzmtf2008 9y ago
  I think you have the idea of sandbox (or at least the idea of sandbox in the context of a web browser) backwards: it means an application (webpage) running inside the sandbox cannot access resources not granted. This side channel access does not run inside a sandbox at all.
  - abecedarius 9y ago
    If you don't consider an OS process a sandbox at all, why are even talking about security here?
    - yzmtf2008 9y ago
      That’s not the point of GP though? The whole premise of virtualization is that an OS process is not a perfect sandbox. There’s a hierarchy of sandboxes. Protecting other processes from accessing something inside the sandbox is not the job of a browser sandbox. This actually just goes to show the GP’s point: not all sandboxes are created equal.

emersion 9y ago

On Linux, Wayland fixes this (+ allows for other security features, e.g. to protect the clipboard).