4 ms·

Yes, it's does not give you SELinux/seccomp level of granularity. But then again, there is a slight chance that users might actually understand what it's for an

by aj3 6y ago

Yes, it's does not give you SELinux/seccomp level of granularity. But then again, there is a slight chance that users might actually understand what it's for and how to use it, unlike SELinux/seccomp. In practice though, if you're a power user you probably won't run shady binaries, and if you do - nothing will protect you from them as your user is likely a member of administrative group / wheel and you use sudo/su/doas somewhat regularly. While if you're worried about protecting your employees/family members, just making sure they are not part of the same admin groups and enforcing basic Software Restriction Policy / AppLocker / SELinux / RBAC will be enough to protect against 99% threats out there.

vladvasiliu 6y ago
I agree that SELinux is much too complex for "regular people". However, the issue I see with this approach is that the default location for saving pretty much everything on Windows is the Documents folder. So I think most people would just blindly agree to give access to this folder. Most malware comes from apps people wilfully install, so they would probably grant them access to the folders because they would want to use them. The approach I like best is what MacOS does, where you have to approve access to a specific folder. The drawback of the MacOS implementation is that I cannot define specific folders I want protected (say .ssh).
- aj3 6y ago
  I agree, at least an option to have more granularity would be a good thing. Maybe the upcoming changes to Android/iOS permission models will solve the problem of UI/UX and this will finally become fashionable. However, there is also a question of properly enforcing granular per-process restrictions (without breaking backwards compatibility). It's not a trivial task, there are plenty of corner cases: race conditions, symlinks, alternate data streams, process hollowing... I don't expect any implementation to be full-proof in the first decade.

by aj3 6y ago

vladvasiliu 6y ago

I agree that SELinux is much too complex for "regular people". However, the issue I see with this approach is that the default location for saving pretty much everything on Windows is the Documents folder. So I think most people would just blindly agree to give access to this folder. Most malware comes from apps people wilfully install, so they would probably grant them access to the folders because they would want to use them. The approach I like best is what MacOS does, where you have to approve access to a specific folder. The drawback of the MacOS implementation is that I cannot define specific folders I want protected (say .ssh).

aj3 6y ago
I agree, at least an option to have more granularity would be a good thing. Maybe the upcoming changes to Android/iOS permission models will solve the problem of UI/UX and this will finally become fashionable. However, there is also a question of properly enforcing granular per-process restrictions (without breaking backwards compatibility). It's not a trivial task, there are plenty of corner cases: race conditions, symlinks, alternate data streams, process hollowing... I don't expect any implementation to be full-proof in the first decade.