4 ms·

> giving an application access to the input system gives an application access to everything How do you figure? There are systems already (like Wayland) where

by theamk 6y ago

> giving an application access to the input system gives an application access to everything How do you figure? There are systems already (like Wayland) where default access to input only gives you input when the app is active, and entire different process is required for global hotkeys or key logging. There are no nice GUIs to manage that AFAIK, but this is not an impossible problem to solve anymore. > The same of course applies to giving it access to the file system. uh, what? no. giving a browser access only to "~/Downloads" will work great and will make it much more secure. The modern Linux is much more than capabilities and user-based permissions. A mount namespace with selectively bind-mounted dirs can do wonders for security. And things like "bindfs" which can translate UIDs on the fly can give even more isolation.

Blikkentrekker 6y ago
> How do you figure? There are systems already (like Wayland) where default access to input only gives you input when the app is active, and entire different process is required for global hotkeys or key logging. That's not what is commonly understood as access to the input system. > There are no nice GUIs to manage that AFAIK, but this is not an impossible problem to solve anymore. So long you be willing to live with a walled garden environment where one's text editor either can't edit the files on one's system any more, or is given sufficient permissions to circumvent all of this regardless. > uh, what? no. giving a browser access only to "~/Downloads" will work great and will make it much more secure. It would also mean that no modern browser works any more since they need access to far more to even start up. You should `strace` a browser and be surprised that it constantly needs to read and write files from all over the system. I would also be rather annoyed with a browser that can only save files in one folder rather than wherever it please me. Finally, even if this browser only have access to `~/Downloads`, it would still be capable of modifying any file that something else put there, thus allowing it to easily install malware into anything that anything els downloads, without the user's knowledge. > The modern Linux is much more than capabilities and user-based permissions. A mount namespace with selectively bind-mounted dirs can do wonders for security. And things like "bindfs" which can translate UIDs on the fly can give even more isolation. There is a good reason that SELinux never truly penetrated: — it is capable of much of this, but it would also make most applications unworkable and users would complain about no longer being able to do as they will. More or less what the situation is on Android, or Windows.
- saagarjha 6y ago
  > That's not what is commonly understood as access to the input system. Then most apps have no need to have access to the input system. > So long you be willing to live with a walled garden environment where one's text editor either can't edit the files on one's system any more, or is given sufficient permissions to circumvent all of this regardless. Sandboxing does not mean the OS cannot extend the sandbox on demand in response to user consent. > You should `strace` a browser and be surprised that it constantly needs to read and write files from all over the system. These should be enumerable. > I would also be rather annoyed with a browser that can only save files in one folder rather than wherever it please me. See above for sandbox extensions.
  - Blikkentrekker 6y ago
    > Then most apps have no need to have access to the input system. I never said as much; I simply said that giving them access to it is tantamount to giving them full access, and that many other such privileges also are. Eventually, the list is so large that many applications need access to at least one thing from which they may escalate to full access. > Sandboxing does not mean the OS cannot extend the sandbox on demand in response to user consent. The point is that as soon as one have given the text editor consent to write to arbitrary text files on the system, one has given it full access as now it can edit the file that contains these permissions. In the alternative, one has to grant it access to files, or directories, on an individual basis with every save, which is something users will quickly grow tired off, especially if it be configured to periodically save. > These should be enumerable. They are, and users will quickly complain that it becomes unworkable to grant access to each of these individually. > See above for sandbox extensions. I would also become annoyed very quickly if I had to give permissions again every time I wanted to save elsewhere. And you didn't address the fact that if he browser have recursive write permissions to the `~/Downloads` folder, it can alter anything that any other application downloaded to it, and thus install whatever malware it wish in there. What you want can work in theory, but few users would be willing to live with their the extreme reduction in quality of life and productivity, or walled garden that results from it.

by theamk 6y ago

Blikkentrekker 6y ago

> How do you figure? There are systems already (like Wayland) where default access to input only gives you input when the app is active, and entire different process is required for global hotkeys or key logging. That's not what is commonly understood as access to the input system. > There are no nice GUIs to manage that AFAIK, but this is not an impossible problem to solve anymore. So long you be willing to live with a walled garden environment where one's text editor either can't edit the files on one's system any more, or is given sufficient permissions to circumvent all of this regardless. > uh, what? no. giving a browser access only to "~/Downloads" will work great and will make it much more secure. It would also mean that no modern browser works any more since they need access to far more to even start up. You should `strace` a browser and be surprised that it constantly needs to read and write files from all over the system. I would also be rather annoyed with a browser that can only save files in one folder rather than wherever it please me. Finally, even if this browser only have access to `~/Downloads`, it would still be capable of modifying any file that something else put there, thus allowing it to easily install malware into anything that anything els downloads, without the user's knowledge. > The modern Linux is much more than capabilities and user-based permissions. A mount namespace with selectively bind-mounted dirs can do wonders for security. And things like "bindfs" which can translate UIDs on the fly can give even more isolation. There is a good reason that SELinux never truly penetrated: — it is capable of much of this, but it would also make most applications unworkable and users would complain about no longer being able to do as they will. More or less what the situation is on Android, or Windows.

saagarjha 6y ago
> That's not what is commonly understood as access to the input system. Then most apps have no need to have access to the input system. > So long you be willing to live with a walled garden environment where one's text editor either can't edit the files on one's system any more, or is given sufficient permissions to circumvent all of this regardless. Sandboxing does not mean the OS cannot extend the sandbox on demand in response to user consent. > You should `strace` a browser and be surprised that it constantly needs to read and write files from all over the system. These should be enumerable. > I would also be rather annoyed with a browser that can only save files in one folder rather than wherever it please me. See above for sandbox extensions.
- Blikkentrekker 6y ago
  > Then most apps have no need to have access to the input system. I never said as much; I simply said that giving them access to it is tantamount to giving them full access, and that many other such privileges also are. Eventually, the list is so large that many applications need access to at least one thing from which they may escalate to full access. > Sandboxing does not mean the OS cannot extend the sandbox on demand in response to user consent. The point is that as soon as one have given the text editor consent to write to arbitrary text files on the system, one has given it full access as now it can edit the file that contains these permissions. In the alternative, one has to grant it access to files, or directories, on an individual basis with every save, which is something users will quickly grow tired off, especially if it be configured to periodically save. > These should be enumerable. They are, and users will quickly complain that it becomes unworkable to grant access to each of these individually. > See above for sandbox extensions. I would also become annoyed very quickly if I had to give permissions again every time I wanted to save elsewhere. And you didn't address the fact that if he browser have recursive write permissions to the `~/Downloads` folder, it can alter anything that any other application downloaded to it, and thus install whatever malware it wish in there. What you want can work in theory, but few users would be willing to live with their the extreme reduction in quality of life and productivity, or walled garden that results from it.