4 ms·

> Linux is not a secure operating system. [Click link for an explanation by the same author] > There is no strong sandboxing in the standard Linux desktop. [.

by ikurei 6y ago

> Linux is not a secure operating system. [Click link for an explanation by the same author] > There is no strong sandboxing in the standard Linux desktop. [...] This is in contrast to other desktop operating systems such as macOS or Windows 10 [...]. Windows automatically sandboxes UWP applications and provides the Windows Sandbox utility for non-UWP applications. Is this actually fair? Windows Sandbox is not that different from using docker, or even better a VM, is it? It's great that UWP apps are sandboxed, but they're a minority of the apps people use. I don't get how Windows gets a point over Linux here. Running all or most apps in a sandbox without the user even noticing improves security, but neither OS really do that effectively. Windows Sandbox is cool, and Linux doesn't have something like that out of the box, but a VM is easy to install and create no?

vbezhenar 6y ago
IMO UWP sandboxing is not useful. I don’t have a single UWP application and I use my PC for a lot of tasks.
- pjmlp 6y ago
  Which is why Win32 sandboxing is part of Windows 10 X feature set.
voltagex_ 6y ago
Device Guard and some other Defender features I'm forgetting the name of are pretty cool, I think they're even in 10 Home now. I don't think all Store apps are sandboxed now, either. I don't think it's fair to compare Linux without AppArmor or SELinux, really. Someone more versed in both may be able to provide more info. If I was as worried as the author and had a risk model to back it up I'd probably run QUBES or OpenBSD or both.
danieldk 6y ago
It's great that UWP apps are sandboxed, but they're a minority of the apps people use. It's not just sandboxing of UWP apps and Windows Sandbox. Recent Windows 10 version have a feature called 'Controlled folder access' where you can designate certain folders as being protected (besides the Windows system folders). If any non-whitelisted application attempts to access these folders, you get a notification and their access is blocked by default. You can then whitelist the application if you want to grant it access. It's more course-grained than fully sandboxes application, but it's a nice extra layer of defense for application that do not use sandboxing by default with a portal-based mechanism to request access to certain files/folders. There is more information here: https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/controlled-folders https://docs.microsoft.com/en-us/windows/security/threat-pro... (This should be fairly easy to implement in Linux with a MAC framework like AppArmor/SELinux or perhaps eBPF. But it's not useful for most people until someone actually implements this in a user-friendly manner.)
- pjmlp 6y ago
  Which are some of the ways that Android deviates from GNU/Linux. SELinux, seccomp, eBPF, FORTIFY_SOURCE, HSAN,.... all enabled.
  - danieldk 6y ago
    Indeed. Unfortunately it seems nobody in the traditional Linux ecosystem outside Red Hat (and perhaps Canonical's Snap) is really interested in meaningfully improving UI application sandboxing. Flatpak is often met with outright hostility and then some ranting about how OpenBSD's pledge already solves all problems. Sure, Flatpak is not perfect yet and too many Flatpaks still have to use filesystem=home (which usually caused by the application or toolkit not being friendly to sandboxing). But the Flatpak folks at least try to gradually improve security. Disclaimer: I mostly run Linux on the desktop. But application security is definitely a blind spot for the Linux community. Many people still seem to think that UID 0 is the ultimate goal. We are mostly protected by the fact that Linux has ~1% of the desktop and is therefore not an interesting target yet.
    - pjmlp 6y ago
      I am fully with you, although I lost hope on the Desktop GNU/Linux, so just end up using it on a surviving travel netbook. However I do use Ubuntu with AppArmor, Snap and whatever else that Canonical is trying to do to improve the situation.
pjmlp 6y ago
Windows sandboxing can also be applied to Win32, when delivered via MSIX packages, and since Reunion introduction one of the goals is to merge both sandbox models, as per Windows 10X roadmap.
soraminazuki 6y ago
I saw that page too, and the author seems to, uhm, have very strong opinions. The author has this to say about the Linux kernel: > The kernel is also very lacking in security. It is a monolithic kernel, meaning it contains a colossal amount of code all within the most privileged part of the operating system. The kernel has huge attack surface and is constantly adding new and dangerous features. And then goes on about how insecure eBPF and user namespaces are, before concluding with this: > Other kernels such as the Windows and macOS kernels are somewhat similar too in that they are also large and bloated monolithic kernels with huge attack surface but they at least realise that these issues exist and take further steps to mitigate them. This person is clearly bending over backwards in his quest to prove how insecure Linux is compared to the competition. Some of his points are true, but there are so many glaring inaccuracies that I don't even know where to begin with. For instance, many links in that article are bogus. Multiple links that's supposed to showcase vulnerabilities in eBPF and user namespaces are just someone ranting about these features instead of it being an actual bug report. Links to a Debian commit disabling user namespaces are explained as a direct result of security bugs, when it's clear from the code comments that it was disabled only as a preventative measure because it was deemed premature by the maintainers. Actual eBPF vulnerabilities linked in the article requires eBPF JIT, a feature disabled by default but not stated as such. And so much more...
deckard1 6y ago
Yeah, he lost me when he compared Linux file access to MS-DOS. Really now? Even 1995 Linux was nothing like MS-DOS. Sure, POSIX is nothing to be admired. But it had some security for fucks sake. Users generally can't see other users' files without an exploit. Whereas MS-DOS... doesn't have users. Which... I mean, what the fuck are we even talking about now?

by ikurei 6y ago

vbezhenar 6y ago

IMO UWP sandboxing is not useful. I don’t have a single UWP application and I use my PC for a lot of tasks.

pjmlp 6y ago
Which is why Win32 sandboxing is part of Windows 10 X feature set.

voltagex_ 6y ago

Device Guard and some other Defender features I'm forgetting the name of are pretty cool, I think they're even in 10 Home now. I don't think all Store apps are sandboxed now, either. I don't think it's fair to compare Linux without AppArmor or SELinux, really. Someone more versed in both may be able to provide more info. If I was as worried as the author and had a risk model to back it up I'd probably run QUBES or OpenBSD or both.

danieldk 6y ago

It's great that UWP apps are sandboxed, but they're a minority of the apps people use. It's not just sandboxing of UWP apps and Windows Sandbox. Recent Windows 10 version have a feature called 'Controlled folder access' where you can designate certain folders as being protected (besides the Windows system folders). If any non-whitelisted application attempts to access these folders, you get a notification and their access is blocked by default. You can then whitelist the application if you want to grant it access. It's more course-grained than fully sandboxes application, but it's a nice extra layer of defense for application that do not use sandboxing by default with a portal-based mechanism to request access to certain files/folders. There is more information here: https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/controlled-folders https://docs.microsoft.com/en-us/windows/security/threat-pro... (This should be fairly easy to implement in Linux with a MAC framework like AppArmor/SELinux or perhaps eBPF. But it's not useful for most people until someone actually implements this in a user-friendly manner.)

pjmlp 6y ago
Which are some of the ways that Android deviates from GNU/Linux. SELinux, seccomp, eBPF, FORTIFY_SOURCE, HSAN,.... all enabled.
- danieldk 6y ago
  Indeed. Unfortunately it seems nobody in the traditional Linux ecosystem outside Red Hat (and perhaps Canonical's Snap) is really interested in meaningfully improving UI application sandboxing. Flatpak is often met with outright hostility and then some ranting about how OpenBSD's pledge already solves all problems. Sure, Flatpak is not perfect yet and too many Flatpaks still have to use filesystem=home (which usually caused by the application or toolkit not being friendly to sandboxing). But the Flatpak folks at least try to gradually improve security. Disclaimer: I mostly run Linux on the desktop. But application security is definitely a blind spot for the Linux community. Many people still seem to think that UID 0 is the ultimate goal. We are mostly protected by the fact that Linux has ~1% of the desktop and is therefore not an interesting target yet.
  - pjmlp 6y ago
    I am fully with you, although I lost hope on the Desktop GNU/Linux, so just end up using it on a surviving travel netbook. However I do use Ubuntu with AppArmor, Snap and whatever else that Canonical is trying to do to improve the situation.

pjmlp 6y ago

Windows sandboxing can also be applied to Win32, when delivered via MSIX packages, and since Reunion introduction one of the goals is to merge both sandbox models, as per Windows 10X roadmap.

soraminazuki 6y ago

I saw that page too, and the author seems to, uhm, have very strong opinions. The author has this to say about the Linux kernel: > The kernel is also very lacking in security. It is a monolithic kernel, meaning it contains a colossal amount of code all within the most privileged part of the operating system. The kernel has huge attack surface and is constantly adding new and dangerous features. And then goes on about how insecure eBPF and user namespaces are, before concluding with this: > Other kernels such as the Windows and macOS kernels are somewhat similar too in that they are also large and bloated monolithic kernels with huge attack surface but they at least realise that these issues exist and take further steps to mitigate them. This person is clearly bending over backwards in his quest to prove how insecure Linux is compared to the competition. Some of his points are true, but there are so many glaring inaccuracies that I don't even know where to begin with. For instance, many links in that article are bogus. Multiple links that's supposed to showcase vulnerabilities in eBPF and user namespaces are just someone ranting about these features instead of it being an actual bug report. Links to a Debian commit disabling user namespaces are explained as a direct result of security bugs, when it's clear from the code comments that it was disabled only as a preventative measure because it was deemed premature by the maintainers. Actual eBPF vulnerabilities linked in the article requires eBPF JIT, a feature disabled by default but not stated as such. And so much more...

deckard1 6y ago

Yeah, he lost me when he compared Linux file access to MS-DOS. Really now? Even 1995 Linux was nothing like MS-DOS. Sure, POSIX is nothing to be admired. But it had some security for fucks sake. Users generally can't see other users' files without an exploit. Whereas MS-DOS... doesn't have users. Which... I mean, what the fuck are we even talking about now?