4 ms·
>The history of local root exploits ("Cheap and easy!") would argue that doing such a thing and relying on the kernel is just security theater. it may not be p
by coconut08 4y ago
>The history of local root exploits ("Cheap and easy!") would argue that doing such a thing and relying on the kernel is just security theater.
it may not be perfect but surely its better than nothing. it wouldn't protect you from a sophisticated nation state attacker, but most people don't have that in their threat model. surely it would be good enough to prevent google chrome from snooping through your home directory and other such things.
- yjftsjthsd-h 4y ago> surely it would be good enough to prevent google chrome from snooping through your home directory and other such things. You want firejail, I think; this is one of its headline features. (Or possibly bubblewrap.)
- eloy 4y agoPlease do not use firejail. See this issue page: https://gitlab.alpinelinux.org/alpine/aports/-/issues/12635 https://gitlab.alpinelinux.org/alpine/aports/-/issues/12635 Bubblejail is an acceptable alternative https://github.com/igo95862/bubblejail https://github.com/igo95862/bubblejail
- yjftsjthsd-h 4y agoThat is a somewhat controversial claim. See also this issue page: https://github.com/netblue30/firejail/issues/3046 https://github.com/netblue30/firejail/issues/3046 Also, bubblejail ships all of 8 profiles; I'm skeptical of its claim to be a full replacement.