4 ms·
>Also, @cgwalters thinks trying to whitelist file paths is a bad idea given the myriad ways users have to manipulate paths, and the myriad ways in which system
by lvass 5y ago
>Also, @cgwalters thinks trying to whitelist file paths is a bad idea given the myriad ways users have to manipulate paths, and the myriad ways in which system administrators may configure a system.
So you either get the entire filesystem or no file access? Isn't this a huge dealbreaker for almost everything?
- iancarroll 5y agoI think this is just a comment on Firejail's implementation, as I think Firejail runs as root and thus must enforce its own permission checks. It seems like bubblewrap uses a mount namespace created by the current user which would allow controlling access without any special checks.
- dj_gitmo 5y agoI'm running firejail now and It doesn't look like it runs as root.
- anderspitman 5y agoCorrect, it is an SUID executable[0], as is bubblewrap. [0]: https://en.m.wikipedia.org/wiki/Setuid https://en.m.wikipedia.org/wiki/Setuid
- jwilk 5y agoThis is poorly documented, but if the kernel supports unprivileged user namespaces, bubblewrap works without suid.
- anderspitman 5y agoGood to know, thanks.
- yjftsjthsd-h 5y agoDoes/can firejail, or is that a difference?
- WhyNotHugo 5y agobubblewrap is only setuid if user namespaces are unavailable.
- emmelaich 5y agoBetter to use selinux than path whitelisting.