3 ms·
> apps There should be some very good definition for "App". I expect xz(1) to to be able to read any file I give to it (% xz myfile). I would however expect
by moviuro 9y ago
> apps
There should be some very good definition for "App". I expect xz(1) to to be able to read any file I give to it (% xz myfile).
I would however expect chromium to only modify stuff in ~/.config/chromium ~/Downloads and be able to read only the libs it needs in /lib. But what about if I need to render an HTML page that's in ~/git/my.blog/index.html?
OpenBSD did some great things with pledge(2)[0] but truly fine-grained control like SELinux, AppArmor have met only limited success because of how complex they are to setup.
[0] http://man.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man2/pledge.2?query=pledge http://man.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man2/...