4 ms·

This site has been posted here multiple times in the past. I'd still like to know what the author suggests the alternative should be? I'm a Qubes OS user, whic

This site has been posted here multiple times in the past. I'd still like to know what the author suggests the alternative should be? I'm a Qubes OS user, which indeed is a much better solution in terms of security, but it comes with plenty of drawbacks that a lot of users might not be willing to accept. It's also difficult to use for people who are not interested in security. Right now, there is literally only one project in the Linux community that even tries to address the enormous hole which is Linux security, and that is indeed Flatpak. It's not a perfect solution, and they still have some way to go, but there really is no other way unless you want go to Qubes OS.

eikenberry 5y ago
Have you looked at Firejail? It presents several options to contain applications, working on existing packages and AppImages. You could see it as a more easily configured verfsion of the security parts of Flatpaks without the application parts. https://firejail.wordpress.com/ https://firejail.wordpress.com/
- zxzax 5y ago
  Firejail can easily suffer from some of the same issues, if it's not configured properly. Some of the issues listed here are not specific to Flatpak, and need to be addressed with any sandboxing mechanism.
  - eikenberry 5y ago
    Firejail is a tool, and a pretty nice one. But it isn't simple to use yet. But with support for using overlay filesystems for home or root, combined with cgroups isolation and it covers the issues that site brings up.
    - zxzax 5y ago
      Flatpak handles all that too, all these tools are using the same Linux security primitives. There is really not any difference between them from a security perspective. Technically flatpak is based around bubblewrap for some of the low level bits, which is kind of like an even simpler version of firejail: https://github.com/containers/bubblewrap https://github.com/containers/bubblewrap
    - kaba0 5y ago
      I’ve read a security researcher’s option on firejail - that it is problematic as it is a suid executable. Making a potential bug into a root exploit. Could someone verify/disprove this? I would guess it drops privileges as soon as they are not needed but didn’t yet have the time to look at it and I have no sufficient knowledge to say whether privilege dropping is enough.
      - zxzax 5y ago
        It really depends on what you're trying to do. Doing some things on some distros is still not possible without having the setuid bit.
- lokedhs 5y ago
  I have, and while it's likely that I would be able to use it correctly, it's not something most regular users would be able to configure. And to be honest it seems that to configure firejail to be as secure as possible takes a lot more effort than using Qubes OS. Both solutions seem to be squarely in the domain of people who who understand security, which excludes the people who needs it the most.
nuker 5y ago
> I'd still like to know what the author suggests the alternative should be? I think MacOS handles app security right.
- BossingAround 5y ago
  Not allowing users to run any unsigned binaries by default, such as a Go binary from your coworker, is somewhat against the Linux philosophy.
  - nuker 5y ago
    $ spctl --add myFancyBinary Yes, defaults matter, 99% users don’t have friends that ask them to run their binaries :)
    - BossingAround 5y ago
      A matter of philosophy. This would not fly in Linux distributions.
  - kaba0 5y ago
    You can run it, but it should not be by default allowed and a warning for its questionable origin is very handy.
    - BossingAround 5y ago
      You can delete your whole Linux installation with a single dd command. As I said, this is a matter of philosophy.
- lokedhs 5y ago
  Doesn't macos give full access to a trusted application? In order words, if I decide to trust a binary I downloaded from the Internet, it will be able to touch all my files? What I want to see if that the files an application can use be limited to some subset of all the files on the machine. One can spend a lot of time discussing the level of separation that is appropriate, but just because I trust an application doesn't mean I want it to be able to have full control of my system.

eikenberry 5y ago

Have you looked at Firejail? It presents several options to contain applications, working on existing packages and AppImages. You could see it as a more easily configured verfsion of the security parts of Flatpaks without the application parts. https://firejail.wordpress.com/ https://firejail.wordpress.com/

zxzax 5y ago
Firejail can easily suffer from some of the same issues, if it's not configured properly. Some of the issues listed here are not specific to Flatpak, and need to be addressed with any sandboxing mechanism.
- eikenberry 5y ago
  Firejail is a tool, and a pretty nice one. But it isn't simple to use yet. But with support for using overlay filesystems for home or root, combined with cgroups isolation and it covers the issues that site brings up.
  - zxzax 5y ago
    Flatpak handles all that too, all these tools are using the same Linux security primitives. There is really not any difference between them from a security perspective. Technically flatpak is based around bubblewrap for some of the low level bits, which is kind of like an even simpler version of firejail: https://github.com/containers/bubblewrap https://github.com/containers/bubblewrap
  - kaba0 5y ago
    I’ve read a security researcher’s option on firejail - that it is problematic as it is a suid executable. Making a potential bug into a root exploit. Could someone verify/disprove this? I would guess it drops privileges as soon as they are not needed but didn’t yet have the time to look at it and I have no sufficient knowledge to say whether privilege dropping is enough.
    - zxzax 5y ago
      It really depends on what you're trying to do. Doing some things on some distros is still not possible without having the setuid bit.
lokedhs 5y ago
I have, and while it's likely that I would be able to use it correctly, it's not something most regular users would be able to configure. And to be honest it seems that to configure firejail to be as secure as possible takes a lot more effort than using Qubes OS. Both solutions seem to be squarely in the domain of people who who understand security, which excludes the people who needs it the most.

nuker 5y ago

> I'd still like to know what the author suggests the alternative should be? I think MacOS handles app security right.

BossingAround 5y ago
Not allowing users to run any unsigned binaries by default, such as a Go binary from your coworker, is somewhat against the Linux philosophy.
- nuker 5y ago
  $ spctl --add myFancyBinary Yes, defaults matter, 99% users don’t have friends that ask them to run their binaries :)
  - BossingAround 5y ago
    A matter of philosophy. This would not fly in Linux distributions.
- kaba0 5y ago
  You can run it, but it should not be by default allowed and a warning for its questionable origin is very handy.
  - BossingAround 5y ago
    You can delete your whole Linux installation with a single dd command. As I said, this is a matter of philosophy.
lokedhs 5y ago
Doesn't macos give full access to a trusted application? In order words, if I decide to trust a binary I downloaded from the Internet, it will be able to touch all my files? What I want to see if that the files an application can use be limited to some subset of all the files on the machine. One can spend a lot of time discussing the level of separation that is appropriate, but just because I trust an application doesn't mean I want it to be able to have full control of my system.