7 ms·

It is sandboxed from filesystem access, but as soon as it is launched, it asks the user for permission to access their home directory. Really this is just an i

It is sandboxed from filesystem access, but as soon as it is launched, it asks the user for permission to access their home directory. Really this is just an indictment of old-school massive deep tree file organisation, and of Unix file permission being too coarse-grained for what are effectively single-user computers.

comboy 8y ago
I wonder if there's any chance of improvement of that under linux. Only chrome needs access to my chrome data directory. It also doesn't usually need access to anything outside it. There's not that much use of solid security preventing apps from gaining the root access when all my sensitive data is accessible from my user.
- ComodoHacker 8y ago
  Linux has AppArmor and other tools to solve that. What it lacks are tons of paid man-hours to develop, test and maintain templates for popular apps.
  - drb91 8y ago
    Is there a decent UX for apparmor controls?
- EvilTerran 8y ago
  Qubes OS (https://www.qubes-os.org/ https://www.qubes-os.org/) seems relevant: that sandboxes every application into its own VM. It's a hell of a brute-force approach to application isolation, but I guess it's the most robust strategy available.
- saagarjha 8y ago
  > Only chrome needs access to my chrome data directory. This is changing in macOS Mojave so that databases for things such as email and contacts are inaccessible except through the proper APIs, which present a prompt asking for access.
- danieldk 8y ago
  Flatpak provides application sandboxes similar to macros, with portals to access files outside the sandbox. But you have to use Wayland, sanboxing is pretty useless with X11, since it does not provide GUI isolation.
- QasimK 8y ago
  Firejail is a sandboxing tool that does this (and also restricts access to other things), and it supports many popular programs out of the box. I’m going to say it supports Chrome because I know it supports Firefox.
  - comboy 8y ago
    Thanks, I didn't know about it.
ChrisSD 8y ago
While I agree in principle, in this case I'm not sure any permission system would help. An anti malware program has legitimate reason to access the internet. It also has legitimate reason to read files. Heck it may even have legitimate reason to upload some of that data for analysis. Those first two capabilities are very hard to keep separate (you'd need one process for each capability and a very tight restriction on interprocess communication). The third is game over. I think ultimately the problem is more about trust and oversight.
- drb91 8y ago
  The type and destination of the network request would be useful to block/allow as necessary, ala little snitch. However, IMHO AV software should be reviewed as such. They clearly didn’t do this. What is the point of the app store? It seems to be a proxy into sandboxing, but it’s hardly useful if there’s no review that the sandbox is effective, and the sandboxing would be more useful decoupled from the app store so that you can sandbox arbitrary apps. If the controls are there, it’s not obvious.

comboy 8y ago

I wonder if there's any chance of improvement of that under linux. Only chrome needs access to my chrome data directory. It also doesn't usually need access to anything outside it. There's not that much use of solid security preventing apps from gaining the root access when all my sensitive data is accessible from my user.

ComodoHacker 8y ago
Linux has AppArmor and other tools to solve that. What it lacks are tons of paid man-hours to develop, test and maintain templates for popular apps.
- drb91 8y ago
  Is there a decent UX for apparmor controls?
EvilTerran 8y ago
Qubes OS (https://www.qubes-os.org/ https://www.qubes-os.org/) seems relevant: that sandboxes every application into its own VM. It's a hell of a brute-force approach to application isolation, but I guess it's the most robust strategy available.
saagarjha 8y ago
> Only chrome needs access to my chrome data directory. This is changing in macOS Mojave so that databases for things such as email and contacts are inaccessible except through the proper APIs, which present a prompt asking for access.
danieldk 8y ago
Flatpak provides application sandboxes similar to macros, with portals to access files outside the sandbox. But you have to use Wayland, sanboxing is pretty useless with X11, since it does not provide GUI isolation.
QasimK 8y ago
Firejail is a sandboxing tool that does this (and also restricts access to other things), and it supports many popular programs out of the box. I’m going to say it supports Chrome because I know it supports Firefox.
- comboy 8y ago
  Thanks, I didn't know about it.

ChrisSD 8y ago

While I agree in principle, in this case I'm not sure any permission system would help. An anti malware program has legitimate reason to access the internet. It also has legitimate reason to read files. Heck it may even have legitimate reason to upload some of that data for analysis. Those first two capabilities are very hard to keep separate (you'd need one process for each capability and a very tight restriction on interprocess communication). The third is game over. I think ultimately the problem is more about trust and oversight.

drb91 8y ago
The type and destination of the network request would be useful to block/allow as necessary, ala little snitch. However, IMHO AV software should be reviewed as such. They clearly didn’t do this. What is the point of the app store? It seems to be a proxy into sandboxing, but it’s hardly useful if there’s no review that the sandbox is effective, and the sandboxing would be more useful decoupled from the app store so that you can sandbox arbitrary apps. If the controls are there, it’s not obvious.