5 ms·
On Linux there's Flatpak and Wayland which aim to introduce more protection
by CorrectHorseBat 5y ago
On Linux there's Flatpak and Wayland which aim to introduce more protection
- ncmncm 5y agoNot meaningfully. If you have to install an app, only putting it in a VM can ever help much. If you run X (except on Qubes!) any program can see everything every other X program is doing -- all keystrokes, all mouse clicks, all pixels.
- nicce 5y agoThis is not true. You can write AppArmor rules which can restrict pretty much everything. SELinux is also a thing, and introduces a lot of features that you can't see in the Windows for example. > X program is doing -- all keystrokes, all mouse clicks, all pixels. Parent was mentioning Wayland specifically to remove this threat.
- drran 5y agoIn Linux, just run an app as separate user. Linux is a multi-tenant OS, so users are well protected from each other. If you need to share files with program, share them via a shared folder, e.g. `/tmp`.
- CorrectHorseBat 5y agoDoesn't sound very practical, especially for grahical programs.
- drran 5y agoSecurity is compromise. You can share your whole home directory, if you trust the software, but it will make any kind of protection useless, or you can write a helper tool, which will grant access to a single selected file using a hard link, to make alias for file content, or synchronize files between directories, or mount a shared directory to both container and your home directory, or use SELinux to grant access to a selected directory only. Chose your own compromise.
- CorrectHorseBat 5y agoBut it doesn't have to be such a shitty compromise. Most desktop applications could be made such that you have all the security and the convenience.
- drran 5y agoSeparate user for untrusted apps is the proven way to do that in UNIX. :-/
- CorrectHorseBat 5y agoThat can happen under the hood, but the user should not have to deal with that
- user-the-name 5y agoThat is nowhere near practical.
- drran 5y agoAll system daemons are running this way. It's the standard way to isolate networking services on UNIX.
- user-the-name 5y agoAnd no user-facing UI apps do this or are built for it, and no desktop environment has any kind of support for doing it. It just doesn't work in practice.
- drran 5y agoDesktop environments have nothing to do with that: it's the job of distribution. `gksu` is popular to run graphical apps under root or another user, for example, until it was removed from distributions because distributions don't want to allow users to run untrusted apps as root.
- periheli0n 5y agoThis is how Android does security AFAIK — every app is run as a different user.
- boring_twenties 5y agoIf they connect to the same X display, it doesn't matter what user they run as.
- drran 5y agoSo, give separate X server (Xephyr, Xnest, Xvnc) per app for increased security. They will be isolated from clipboard, window titles, and broadcasted key events.
- boring_twenties 5y agoYes, but in my experience at least, Firefox is not usable running under Xephyr. It's simply too slow for regular web browsing, forget about trying to watch any kind of video. In theory, the X11 Security Extension would seem to provide a middle ground. On the plus side, I don't notice any performance impact when running Firefox as an untrusted client. However, most programs aren't coded correctly to coexist with it. For example, Firefox crashes regularly when running as such (via SIGSEGV no less, which is its own yikes). Not only that but many programs that are themselves trusted (i.e. normal/default X11 clients) will misbehave if they are simply near an untrusted client: LibreOffice Calc, for example, will lock up hard if the untrusted clipboard is in use.
- drran 5y agoYou can run each program in full screen on a separate instance of Xephyr or Xnest, so the program will have a whole separate X server to play with in isolation. Good for running Raspberry Pi desktop via `ssh -X` or `ssh -Y`.