3 ms·
Could also work with file access. Most applications never need to access the whole filesystem. My browser mostly needs access to the profile-specific data and t
by alpaca128 5y ago
Could also work with file access. Most applications never need to access the whole filesystem. My browser mostly needs access to the profile-specific data and the downloads folder. A music player doesn't need access to anything outside the music directory and also no networking unless maybe that one URL it uses to load album cover images.
Although I'd only prefer this approach if it's actually done right. Android, Flatpak etc. mostly showed ways to do it badly.
- matheusmoreira 5y agoAgreed. We need ways to filter every Linux system call. Not just disallow the system calls themselves. We need the ability to apply policies to parameters and filter I/O in a transparent way.
- jfrunyon 5y agohttps://en.wikipedia.org/wiki/Systrace https://en.wikipedia.org/wiki/Systrace https://en.wikipedia.org/wiki/Linux_Security_Modules https://en.wikipedia.org/wiki/Linux_Security_Modules
- jfrunyon 5y agohttps://wiki.ubuntu.com/AppArmor https://wiki.ubuntu.com/AppArmor ???