3 ms·

I run such less trusted programs on other machines. The privilege elevation attack surface is just too big on a normal Linux system. That's why I think intra-u

I run such less trusted programs on other machines. The privilege elevation attack surface is just too big on a normal Linux system. That's why I think intra-user isolation is better. I would feel so much better if my browser could just access its settings, the download directory, and read access outside my home directory (for libs and such).

still_grokking 6y ago
Isn't SELinux supposed to provide exactly this functionality? The tricky part are the profiles afaik. But this could be solved with some concentrated community effort I guess. I think AppArmor does something similar (I don't know the differences to SELinux in detail, so if someone like to clarify please go ahead). I remember I've seen some AppArmor related stuff regarding Firefox (and LibreOffice I think) in Ubuntu. So seems not much is missing to have at least an sandboxed web browser out-of-the-box on a Linux desktop.
- 0xC0ncord 6y ago
  SELinux can and does do exactly this, depending on the configuration. What you'll most often see is that applications covered will have rules that allow it to access a subset of the user's home content (xdg cache, data, etc.) that allow that application to function, and SELinux will use UBAC rules to ensure that user A's instance of that application cannot access the data of user B's. Profiles are indeed tricky though, and generally something I would consider more easily implemented as just logging in as a different user. I can't speak much about AppArmor since I'm not too familiar with it.
- yrro 6y ago
  SELinux can do this--think of it as a second layer of security that is checked after the normal DAC checks (e.g., process uid vs file permissions) succeed.
fsflover 6y ago
> I run such less trusted programs on other machines. You could probably use Qubes OS instead.
- knorker 6y ago
  I tried that for a while. Don't remember why I gave up, but it could have been abysmal youtube performance or laptop suspend issues. It's been a while, though. But now I'm also spoiled with Sway. Haven't checked if I can keep Sway on qubes.
mschuster91 6y ago
> I would feel so much better if my browser could just access its settings, the download directory, and read access outside my home directory (for libs and such). I regularly have to both download files to other directories than my Download folder and upload files from other directories, such a restriction would break a lot of existing use cases. The optimal way to achieve this would be to have the file / save picker a completely separate process, which then passes a token to the browser, which the browser then exchanges at some sort of "broker" process that returns a handle to the file.
shaicoleman 6y ago
Easiest way to do it is to install via Flatpak, e.g. for Chromium with only access to the Downloads directory: sudo flatpak remote-add --if-not-exists flathub https://dl.flathub.org/repo/flathub.flatpakrepo sudo flatpak install -y flathub org.chromium.Chromium sudo flatpak override org.chromium.Chromium --nofilesystem=home --filesystem=$HOME/Downloads

still_grokking 6y ago

Isn't SELinux supposed to provide exactly this functionality? The tricky part are the profiles afaik. But this could be solved with some concentrated community effort I guess. I think AppArmor does something similar (I don't know the differences to SELinux in detail, so if someone like to clarify please go ahead). I remember I've seen some AppArmor related stuff regarding Firefox (and LibreOffice I think) in Ubuntu. So seems not much is missing to have at least an sandboxed web browser out-of-the-box on a Linux desktop.

0xC0ncord 6y ago
SELinux can and does do exactly this, depending on the configuration. What you'll most often see is that applications covered will have rules that allow it to access a subset of the user's home content (xdg cache, data, etc.) that allow that application to function, and SELinux will use UBAC rules to ensure that user A's instance of that application cannot access the data of user B's. Profiles are indeed tricky though, and generally something I would consider more easily implemented as just logging in as a different user. I can't speak much about AppArmor since I'm not too familiar with it.
yrro 6y ago
SELinux can do this--think of it as a second layer of security that is checked after the normal DAC checks (e.g., process uid vs file permissions) succeed.

fsflover 6y ago

> I run such less trusted programs on other machines. You could probably use Qubes OS instead.

knorker 6y ago
I tried that for a while. Don't remember why I gave up, but it could have been abysmal youtube performance or laptop suspend issues. It's been a while, though. But now I'm also spoiled with Sway. Haven't checked if I can keep Sway on qubes.

mschuster91 6y ago

> I would feel so much better if my browser could just access its settings, the download directory, and read access outside my home directory (for libs and such). I regularly have to both download files to other directories than my Download folder and upload files from other directories, such a restriction would break a lot of existing use cases. The optimal way to achieve this would be to have the file / save picker a completely separate process, which then passes a token to the browser, which the browser then exchanges at some sort of "broker" process that returns a handle to the file.

shaicoleman 6y ago

Easiest way to do it is to install via Flatpak, e.g. for Chromium with only access to the Downloads directory: sudo flatpak remote-add --if-not-exists flathub https://dl.flathub.org/repo/flathub.flatpakrepo sudo flatpak install -y flathub org.chromium.Chromium sudo flatpak override org.chromium.Chromium --nofilesystem=home --filesystem=$HOME/Downloads