4 ms·
In Linux, just run an app as separate user. Linux is a multi-tenant OS, so users are well protected from each other. If you need to share files with program, sh
by drran 5y ago
In Linux, just run an app as separate user. Linux is a multi-tenant OS, so users are well protected from each other. If you need to share files with program, share them via a shared folder, e.g. `/tmp`.
- CorrectHorseBat 5y agoDoesn't sound very practical, especially for grahical programs.
- drran 5y agoSecurity is compromise. You can share your whole home directory, if you trust the software, but it will make any kind of protection useless, or you can write a helper tool, which will grant access to a single selected file using a hard link, to make alias for file content, or synchronize files between directories, or mount a shared directory to both container and your home directory, or use SELinux to grant access to a selected directory only. Chose your own compromise.
- CorrectHorseBat 5y agoBut it doesn't have to be such a shitty compromise. Most desktop applications could be made such that you have all the security and the convenience.
- drran 5y agoSeparate user for untrusted apps is the proven way to do that in UNIX. :-/
- CorrectHorseBat 5y agoThat can happen under the hood, but the user should not have to deal with that
- user-the-name 5y agoThat is nowhere near practical.
- drran 5y agoAll system daemons are running this way. It's the standard way to isolate networking services on UNIX.
- user-the-name 5y agoAnd no user-facing UI apps do this or are built for it, and no desktop environment has any kind of support for doing it. It just doesn't work in practice.
- drran 5y agoDesktop environments have nothing to do with that: it's the job of distribution. `gksu` is popular to run graphical apps under root or another user, for example, until it was removed from distributions because distributions don't want to allow users to run untrusted apps as root.
- periheli0n 5y agoThis is how Android does security AFAIK — every app is run as a different user.
- boring_twenties 5y agoIf they connect to the same X display, it doesn't matter what user they run as.
- drran 5y agoSo, give separate X server (Xephyr, Xnest, Xvnc) per app for increased security. They will be isolated from clipboard, window titles, and broadcasted key events.
- boring_twenties 5y agoYes, but in my experience at least, Firefox is not usable running under Xephyr. It's simply too slow for regular web browsing, forget about trying to watch any kind of video. In theory, the X11 Security Extension would seem to provide a middle ground. On the plus side, I don't notice any performance impact when running Firefox as an untrusted client. However, most programs aren't coded correctly to coexist with it. For example, Firefox crashes regularly when running as such (via SIGSEGV no less, which is its own yikes). Not only that but many programs that are themselves trusted (i.e. normal/default X11 clients) will misbehave if they are simply near an untrusted client: LibreOffice Calc, for example, will lock up hard if the untrusted clipboard is in use.