4 ms·

I think proper sandboxing on a traditional Unix is hard enough that ~nobody does it right; you can't let any apps run as the user if you want to prevent them fr

I think proper sandboxing on a traditional Unix is hard enough that ~nobody does it right; you can't let any apps run as the user if you want to prevent them from snooping on each others' files, but the user needs to be able to control all of them. I don't know of a justification for removing /etc/resolv.conf, but I guess "applications' networking should be under the control of the user" is sorta necessary; I think it'd make more sense to do it with network namespaces or iptables rules or something, but /shrug.

phkahler 6y ago
>> you can't let any apps run as the user if you want to prevent them from snooping on each others' files, but the user needs to be able to control all of them. I was thinking about that recently and my conclusion will be highly controversial. In the same way Wayland implements security that X never could, I think the GUI might be a place to implement file and folder access permissions. If the user does not grant access to a file through a dialog, the app couldn't read it. Same for folder access, which would grant an application access to an entire folder or perhaps an entire hierarchy. Obviously this would break some things, but real change may require some of that. How much, I don't know.
- johncolanduoni 6y ago
  This is mostly how the Mac sandbox handles file access actually, by going through blessed, OS-controlled file access dialogs. They call it “Powerbox”: https://developer.apple.com/library/archive/documentation/Security/Conceptual/AppSandboxDesignGuide/AppSandboxInDepth/AppSandboxInDepth.html https://developer.apple.com/library/archive/documentation/Se... IIRC flatpak has something similar too, though I believe it’s opt-in for the apps.