3 ms·
I wonder if there's any chance of improvement of that under linux. Only chrome needs access to my chrome data directory. It also doesn't usually need access to
by comboy 8y ago
I wonder if there's any chance of improvement of that under linux. Only chrome needs access to my chrome data directory. It also doesn't usually need access to anything outside it. There's not that much use of solid security preventing apps from gaining the root access when all my sensitive data is accessible from my user.
- ComodoHacker 8y agoLinux has AppArmor and other tools to solve that. What it lacks are tons of paid man-hours to develop, test and maintain templates for popular apps.
- drb91 8y agoIs there a decent UX for apparmor controls?
- EvilTerran 8y agoQubes OS (https://www.qubes-os.org/ https://www.qubes-os.org/) seems relevant: that sandboxes every application into its own VM. It's a hell of a brute-force approach to application isolation, but I guess it's the most robust strategy available.
- saagarjha 8y ago> Only chrome needs access to my chrome data directory. This is changing in macOS Mojave so that databases for things such as email and contacts are inaccessible except through the proper APIs, which present a prompt asking for access.
- danieldk 8y agoFlatpak provides application sandboxes similar to macros, with portals to access files outside the sandbox. But you have to use Wayland, sanboxing is pretty useless with X11, since it does not provide GUI isolation.
- QasimK 8y agoFirejail is a sandboxing tool that does this (and also restricts access to other things), and it supports many popular programs out of the box. I’m going to say it supports Chrome because I know it supports Firefox.
- comboy 8y agoThanks, I didn't know about it.