4 ms·
When I first realized that any and all code that I execute, has read/write permissions to most of my filesystem, it blew my mind. The OS grants every process it
by whack 7y ago
When I first realized that any and all code that I execute, has read/write permissions to most of my filesystem, it blew my mind. The OS grants every process its own unique virtual-memory-space, specifically to prevent malicious/accidental interference with other processes. It seems like the file-system really should operate on a similar principle as well. Every application should run in a sandboxed environment by default, with exceptions being granted by the user for specific applications that actually do need access to the entire file system.
- umanwizard 7y agoThis is already possible in Linux with mount namespaces, and used by (for example) systemd to block access to /home by services if so configured by the user.
- GordonS 7y agoI wonder if there is a Linux distro out there that works like the OP wanted out-of-the-box, with userland processes sandboxes by default, and providing a slick interface to grant access to areas of the filesystem when wanted? There are so many distros with little differentiation - I'd think something like this would be quite unique (unless it already exists, and I don't know it!)
- filipMar 7y agoDo you mean something like Fedora silverblue?
- olejorgenb 7y agohttps://github.com/netblue30/firejail https://github.com/netblue30/firejail