4 ms·

The problem is that your 'developer workflow' sounds like you are assuming a particular level of insecurity that is unwarranted. Learn about the principle of le

by evgen 5y ago

The problem is that your 'developer workflow' sounds like you are assuming a particular level of insecurity that is unwarranted. Learn about the principle of least authority and try to apply it to your workflows. None of the applications you mention need complete access to the filesystem and in every one of those cases the access could be easily limited to a few directories and you would probably never notice.

viraptor 5y ago
Yes/no. The security policies as they are implemented today just aren't possible to effectively use by developers. I've got a project in progress which allows you to go into the context of a specific project as a selinux policy and then work on it that way. It's hard, it's a lot of work, and there are endless edge cases. This is not me giving up, it's actually hard to build a system where you both enforce realistic restrictions and don't end up going "yeah, whatever, I've got enough of those permission questions" after a week. Consider: An interpreter needs to run homebrew which installs new app, but the same interpreter running a script for your project should not read anything apart from those project files. Same interpreter needs to update local packages via bundle and git, but a random script you run shouldn't be able to access your ssh key via git commands. This is basically impossible to achieve without large compromises outside of selinux right now.
fauigerzigerk 5y ago
>Learn about the principle of least authority and try to apply it to your workflows So how would you apply this principle to the python interpreter or to a program that gets compiled to a new executable many times during development? I like the idea of granting folder permissions to regular third party apps I install and use. I always wanted that and I'm glad Apple is moving in this direction with the Mac. But contrary to regular apps, language runtimes and software under development do not have a specific purpose. The whole point of software development is to create and test arbitrary code. It is pointless to grant privileges to code that changes in arbitrary ways with every keystroke. During development, privileges have to be granted to the developer account, not to any particular software artifact. I generally think that granting privileges to software and granting privileges to people each has its legitimate place. One isn't generally better or worse than the other.

by evgen 5y ago

viraptor 5y ago

Yes/no. The security policies as they are implemented today just aren't possible to effectively use by developers. I've got a project in progress which allows you to go into the context of a specific project as a selinux policy and then work on it that way. It's hard, it's a lot of work, and there are endless edge cases. This is not me giving up, it's actually hard to build a system where you both enforce realistic restrictions and don't end up going "yeah, whatever, I've got enough of those permission questions" after a week. Consider: An interpreter needs to run homebrew which installs new app, but the same interpreter running a script for your project should not read anything apart from those project files. Same interpreter needs to update local packages via bundle and git, but a random script you run shouldn't be able to access your ssh key via git commands. This is basically impossible to achieve without large compromises outside of selinux right now.

fauigerzigerk 5y ago

>Learn about the principle of least authority and try to apply it to your workflows So how would you apply this principle to the python interpreter or to a program that gets compiled to a new executable many times during development? I like the idea of granting folder permissions to regular third party apps I install and use. I always wanted that and I'm glad Apple is moving in this direction with the Mac. But contrary to regular apps, language runtimes and software under development do not have a specific purpose. The whole point of software development is to create and test arbitrary code. It is pointless to grant privileges to code that changes in arbitrary ways with every keystroke. During development, privileges have to be granted to the developer account, not to any particular software artifact. I generally think that granting privileges to software and granting privileges to people each has its legitimate place. One isn't generally better or worse than the other.