10 ms·

Linux absolutely has a plethora of software one can use to improve security - AppArmor, Flatpak, Snap, and whatnot; the "all or nothing" approach the author men

Linux absolutely has a plethora of software one can use to improve security - AppArmor, Flatpak, Snap, and whatnot; the "all or nothing" approach the author mentioned is also not inherent to Linux, just a common setup people use. You can absolutely limit user access to a subset of superuser commands. The problem is nobody cares. Linux users don't care, and even the users of sandboxed OSes don't care. I'm more irritated by macOS constantly popping up with "iTerm2 wants to access your Documents folder" than comforted. Some distros implemented e.g. AppArmor to generally positive reviews, but Ubuntu's transition to Snaps has been seen very very negatively. Wayland "features" some protections too - apps can't access the global clipboard, or move themselves, screen-record, whatever. And nobody likes it! Because the inconvenience far outweighs the benefits. Overwhelmingly I think the "problem" is that Linux users don't really want, or need, this protection macOS/ChromeOS offers. An aside: Windows has sandboxing? Where?

cerved 3y ago
Windows has UAC, so you run things like root all the time, it's great
- stop50 3y ago
  Its equivalent to polkit
  - phendrenad2 3y ago
    Polkit is a very badly-designed, poorly-executed imitation of UAC. UAC is an operating-system-level system that heuristically detects when an executable is acting as an installer, and prompts the user with a Yes/No prompt (you can see screenshots online). This even works if you're running a terminal command. Terminal command needs administrator access? You get a blocking, modal dialog from the system that forces you to click Yes or No. That's very powerful. Polkit is a component for controlling system-wide privileges in Unix-like operating systems, the manpage is less than 2 pages.
    - MartijnBraam 3y ago
      It's not heuristics, it's executable metadata
      - phendrenad2 3y ago
        The official UAC docs disagree
    - realitythreek 3y ago
      I thought you were wrong about how UAC worked, and then I went looking through Windows Vista docs on UAC and you’re absolutely right. And that’s batshit insane!
    - BenjiWiebe 3y ago
      Terminal commands don't work that way. Open a command prompt, type 'sc stop spooler', and observe the 'Access Denied' message and the lack of a UAC prompt.
      - tiberious726 3y ago
        Read the parent, that's not an installer, you are, like me up until this very moment, assuming UAC is sensible
faangsticle 3y ago
> Wayland "features" some protections too - apps can't access the global clipboard, or move themselves, screen-record, whatever. And nobody likes it! Because the inconvenience far outweighs the benefits. The problem is that apps can't request these permissions either, while they are absolutely critical for a select for apps so that a desktop environment can be used for actual work. It's just "use wlroots and figure it out yourself or tough luck"
- its-summertime 3y ago
  I can screen record to websites via firefox, with all involved elements using wayland? This is doable on KDE/Gnome for over a year now I think. Open Broadcasting Software works fine too.
  - deleted 3y ago
    [deleted]
  - faangsticle 3y ago
    Yes, that's because the window managers implemented this themselves because Wayland didn't. So that means most window managers use wlroots to provide the functionality, and a few (KDE/Gnome) are doing their own thing. This also means that if you want to interoperate with them it's different for each window manager (that doesn't use wlroots). Things are somewhat usable now thanks to this, but far from ideal.
    - seba_dos1 3y ago
      > This also means that if you want to interoperate with them it's different for each window manager ...which is abstracted behind desktop portals, so applications like OBS or Firefox don't need to care.
cookiengineer 3y ago
In practice I would argue that AppArmor is worth nothing, because everyone uses it to allow every file access by default. Heck, glibc by default still allows LD_PRELOAD pretty much everywhere, and most distros have available SUID binaries you can hijack, so it's useless sandboxing anyways. Setting aside the absurd amount of self invented config file formats for it (which have so many pitfalls for endusers) I think that firejail is the only viable alternative as a seccomp sandbox. Flatpak's sandbox approach is as useless as AppArmor's approach, nobody can use it because the people that design it seemingly never use it in production apart from their www user test cases. If you try to sandbox a complicated program like Firefox with its hundreds of rendering processes, well, good luck...we'll talk two days later on how much progress you made just creating the config files. I got so pissed by all of it that I started to learn eBPF to build a better sandbox, which I am trying to combine with a smart firewalling approach. But honestly, it's a ton of work, and the lack of profiles for everything makes it really hard to get to production. You literally need to implement something like a "learning mode" that test runs a program, just to figure out what you want to allow or deny. This approach kinda worked for me, but I am now literally writing a DNS filter because resolv.conf as a concept is pretty much useless as well. Once you start building something like this you see yourself 2 years later implementing all kinds of network services which in themselves are attack surfaces already...so you start to question whether it is really all worth it. Even hooking something as "simple" as DNS resolver API calls becomes a task that is a shitload of work until completed.
- PrimeMcFly 3y ago
  Something like RSBAC/SELinux is a good fit. Not sandboxing in the traditional sense, but pretty bulletproof if setup correctly. The problem is the time it takes to do that.
- mid-kid 3y ago
  > Heck, glibc by default still allows LD_PRELOAD pretty much everywhere, and most distros have available SUID binaries you can hijack, so it's useless sandboxing anyways. Common misconception, but no, glibc doesn't allow LD_PRELOAD on suid binaries. Root is the one thing that's well-protected on linux, you cannot get root without the aid of a user giving it to you. Similarly, separation between users is also rather secure, but no desktop user is going to run each application under their own user.
411111111111111 3y ago
> You can absolutely limit user access to a subset of superuser commands. Wasn't that limit basically just a string match? I.e. when you're allowed to do sudo abinary the whitelist will accept whatever is behind that string? So from what I recall, simply adding a new directory to the start of your path will let you execute your own script instead, giving you blanket root permission. Same with chroot on absolute paths, right?
- autoexec 3y ago
  A collection of hashes for each specific binary that now needs to be maintained and updated any time one of them changes seems like it'd be more secure, but also a huge pain. I think if an attacker already has access to my system, can install their own binaries, and then run them by specifying paths at the command line, the security of my linux desktop is already a lost cause
- theamk 3y ago
  Nope, sudo uses hardcoded PATH and not user-supplied one. Doing otherwise would be a huge security hole, and would get fixed quickly. It also clears related variables like PYTHONPATH (the exact list depends on distro) In general, sudo is pretty good with single command grants as long as you use this on the scripts made for the purpose (like shell scripts which take no or a single fixed argument). But granting arbitrary arguments permission to a random system binary is a bad idea, something like --log-output might become an escalation. (And unfortunately the default PATH means to of you want to sudo-exe c binaries from your user's bin, you need full path. I hit this all the time.)
pjmlp 3y ago
> Windows has sandboxing? Where? Since Windows 8, WinRT applications are sandboxed. It also has group policies and Win32 API that are used by the likes of Chrome for process sandboxing. Deployments via MSIX packages also have a kind of lightweight sandoxing, as it builds upon WinRT, but on the classical Win32 side. Now Microsoft is looking into bringing that everywhere, Windows 11 current preview already ships the first steps of full Win32 sandoxing being applied to classical applications, and on the roadmap application signing, with revocation of developer certificates, is already announced that is being worked on.
- barbariangrunge 3y ago
  In what way are applications sandboxed? The average multiplayer steam game basically installs a root kit on your system. Last time I checked, a unity game jam game can read whatever files it wants on your system (I barely tested this, it may have only been true of my own computer?)
  - toast0 3y ago
    If you get apps from the windows store, they're sandboxed. If you're a normal person, and get apps from your browser or any other store, yeah, no sandboxes there.
    - pjmlp 3y ago
      Only if classical Win32. You can also install WinRT/UWP applications via MSIX, and they keep the sandboxing no matter what.
  - pjmlp 3y ago
    Those is a classical Win32 application, not WinRT/UWP. Their time will come and is exactly what is part of Win32 sandboxing currently in preview on Windows 11. Long term roadmap UWP sandboxing model will be enforced on Win32 as well.
  - its-summertime 3y ago
    > The average multiplayer steam game basically installs a root kit on your system. When you click the "Do you want to install a rootkit" button, yes it does.
anonzzzies 3y ago
Users do want it at the point things go wrong. They want it in hindsight I guess. I don’t mind the Mac OS X way (I am not sure how good it is, but it feels good). I don’t see why not every app, in Linux or elsewhere, is not ran in a container and directories are mounted, network access is permitted etc by asking you. When I was forced to used windows (a long time ago), I installed something that alerted me of network access and default blocked it; just switching on the laptop and logging in would give me 10 ‘allow this?’ and that was not only to Microsoft owned domains. This was a while ago, so I cannot even imagine what happens when opening up windows 11. Users do get annoyed, but on the other hand: I am willing to bet, if you check statistics, that 99% of browser (and most other apps) users access folders Pictures and Downloads (and maybe Documents) only, ever. As for urls, every tab must be another sandbox-in-sandbox and by far most of them never need the access to Pictures or Downloads or anything else. So you can surely ask without annoyance. Now a site using assets from another domain are mostly ads, so just block it all and allow manual unblock per domain.
- dizhn 3y ago
  I tried to use an application firewall on Windows and linux too. Fantastic software. However the reality of modern life is the worst offender is your web browser. I wasn't about to verify each destination IP so I ended up blanket allowing the binary. Fine. Then there's also a bunch of system processes on both operating systems that are overloaded. They do so many things using tiny system or kernel level binaries. In the end I disabled the software on both OS.
cvalka 3y ago
Windows Sandbox and Windows MDAG.

cerved 3y ago

Windows has UAC, so you run things like root all the time, it's great

stop50 3y ago
Its equivalent to polkit
- phendrenad2 3y ago
  Polkit is a very badly-designed, poorly-executed imitation of UAC. UAC is an operating-system-level system that heuristically detects when an executable is acting as an installer, and prompts the user with a Yes/No prompt (you can see screenshots online). This even works if you're running a terminal command. Terminal command needs administrator access? You get a blocking, modal dialog from the system that forces you to click Yes or No. That's very powerful. Polkit is a component for controlling system-wide privileges in Unix-like operating systems, the manpage is less than 2 pages.
  - MartijnBraam 3y ago
    It's not heuristics, it's executable metadata
    - phendrenad2 3y ago
      The official UAC docs disagree
  - realitythreek 3y ago
    I thought you were wrong about how UAC worked, and then I went looking through Windows Vista docs on UAC and you’re absolutely right. And that’s batshit insane!
  - BenjiWiebe 3y ago
    Terminal commands don't work that way. Open a command prompt, type 'sc stop spooler', and observe the 'Access Denied' message and the lack of a UAC prompt.
    - tiberious726 3y ago
      Read the parent, that's not an installer, you are, like me up until this very moment, assuming UAC is sensible

faangsticle 3y ago

> Wayland "features" some protections too - apps can't access the global clipboard, or move themselves, screen-record, whatever. And nobody likes it! Because the inconvenience far outweighs the benefits. The problem is that apps can't request these permissions either, while they are absolutely critical for a select for apps so that a desktop environment can be used for actual work. It's just "use wlroots and figure it out yourself or tough luck"

its-summertime 3y ago
I can screen record to websites via firefox, with all involved elements using wayland? This is doable on KDE/Gnome for over a year now I think. Open Broadcasting Software works fine too.
- deleted 3y ago
  [deleted]
- faangsticle 3y ago
  Yes, that's because the window managers implemented this themselves because Wayland didn't. So that means most window managers use wlroots to provide the functionality, and a few (KDE/Gnome) are doing their own thing. This also means that if you want to interoperate with them it's different for each window manager (that doesn't use wlroots). Things are somewhat usable now thanks to this, but far from ideal.
  - seba_dos1 3y ago
    > This also means that if you want to interoperate with them it's different for each window manager ...which is abstracted behind desktop portals, so applications like OBS or Firefox don't need to care.

cookiengineer 3y ago

In practice I would argue that AppArmor is worth nothing, because everyone uses it to allow every file access by default. Heck, glibc by default still allows LD_PRELOAD pretty much everywhere, and most distros have available SUID binaries you can hijack, so it's useless sandboxing anyways. Setting aside the absurd amount of self invented config file formats for it (which have so many pitfalls for endusers) I think that firejail is the only viable alternative as a seccomp sandbox. Flatpak's sandbox approach is as useless as AppArmor's approach, nobody can use it because the people that design it seemingly never use it in production apart from their www user test cases. If you try to sandbox a complicated program like Firefox with its hundreds of rendering processes, well, good luck...we'll talk two days later on how much progress you made just creating the config files. I got so pissed by all of it that I started to learn eBPF to build a better sandbox, which I am trying to combine with a smart firewalling approach. But honestly, it's a ton of work, and the lack of profiles for everything makes it really hard to get to production. You literally need to implement something like a "learning mode" that test runs a program, just to figure out what you want to allow or deny. This approach kinda worked for me, but I am now literally writing a DNS filter because resolv.conf as a concept is pretty much useless as well. Once you start building something like this you see yourself 2 years later implementing all kinds of network services which in themselves are attack surfaces already...so you start to question whether it is really all worth it. Even hooking something as "simple" as DNS resolver API calls becomes a task that is a shitload of work until completed.

PrimeMcFly 3y ago
Something like RSBAC/SELinux is a good fit. Not sandboxing in the traditional sense, but pretty bulletproof if setup correctly. The problem is the time it takes to do that.
mid-kid 3y ago
> Heck, glibc by default still allows LD_PRELOAD pretty much everywhere, and most distros have available SUID binaries you can hijack, so it's useless sandboxing anyways. Common misconception, but no, glibc doesn't allow LD_PRELOAD on suid binaries. Root is the one thing that's well-protected on linux, you cannot get root without the aid of a user giving it to you. Similarly, separation between users is also rather secure, but no desktop user is going to run each application under their own user.

411111111111111 3y ago

> You can absolutely limit user access to a subset of superuser commands. Wasn't that limit basically just a string match? I.e. when you're allowed to do sudo abinary the whitelist will accept whatever is behind that string? So from what I recall, simply adding a new directory to the start of your path will let you execute your own script instead, giving you blanket root permission. Same with chroot on absolute paths, right?

autoexec 3y ago
A collection of hashes for each specific binary that now needs to be maintained and updated any time one of them changes seems like it'd be more secure, but also a huge pain. I think if an attacker already has access to my system, can install their own binaries, and then run them by specifying paths at the command line, the security of my linux desktop is already a lost cause
theamk 3y ago
Nope, sudo uses hardcoded PATH and not user-supplied one. Doing otherwise would be a huge security hole, and would get fixed quickly. It also clears related variables like PYTHONPATH (the exact list depends on distro) In general, sudo is pretty good with single command grants as long as you use this on the scripts made for the purpose (like shell scripts which take no or a single fixed argument). But granting arbitrary arguments permission to a random system binary is a bad idea, something like --log-output might become an escalation. (And unfortunately the default PATH means to of you want to sudo-exe c binaries from your user's bin, you need full path. I hit this all the time.)

pjmlp 3y ago

> Windows has sandboxing? Where? Since Windows 8, WinRT applications are sandboxed. It also has group policies and Win32 API that are used by the likes of Chrome for process sandboxing. Deployments via MSIX packages also have a kind of lightweight sandoxing, as it builds upon WinRT, but on the classical Win32 side. Now Microsoft is looking into bringing that everywhere, Windows 11 current preview already ships the first steps of full Win32 sandoxing being applied to classical applications, and on the roadmap application signing, with revocation of developer certificates, is already announced that is being worked on.

barbariangrunge 3y ago
In what way are applications sandboxed? The average multiplayer steam game basically installs a root kit on your system. Last time I checked, a unity game jam game can read whatever files it wants on your system (I barely tested this, it may have only been true of my own computer?)
- toast0 3y ago
  If you get apps from the windows store, they're sandboxed. If you're a normal person, and get apps from your browser or any other store, yeah, no sandboxes there.
  - pjmlp 3y ago
    Only if classical Win32. You can also install WinRT/UWP applications via MSIX, and they keep the sandboxing no matter what.
- pjmlp 3y ago
  Those is a classical Win32 application, not WinRT/UWP. Their time will come and is exactly what is part of Win32 sandboxing currently in preview on Windows 11. Long term roadmap UWP sandboxing model will be enforced on Win32 as well.
- its-summertime 3y ago
  > The average multiplayer steam game basically installs a root kit on your system. When you click the "Do you want to install a rootkit" button, yes it does.

anonzzzies 3y ago

Users do want it at the point things go wrong. They want it in hindsight I guess. I don’t mind the Mac OS X way (I am not sure how good it is, but it feels good). I don’t see why not every app, in Linux or elsewhere, is not ran in a container and directories are mounted, network access is permitted etc by asking you. When I was forced to used windows (a long time ago), I installed something that alerted me of network access and default blocked it; just switching on the laptop and logging in would give me 10 ‘allow this?’ and that was not only to Microsoft owned domains. This was a while ago, so I cannot even imagine what happens when opening up windows 11. Users do get annoyed, but on the other hand: I am willing to bet, if you check statistics, that 99% of browser (and most other apps) users access folders Pictures and Downloads (and maybe Documents) only, ever. As for urls, every tab must be another sandbox-in-sandbox and by far most of them never need the access to Pictures or Downloads or anything else. So you can surely ask without annoyance. Now a site using assets from another domain are mostly ads, so just block it all and allow manual unblock per domain.

dizhn 3y ago
I tried to use an application firewall on Windows and linux too. Fantastic software. However the reality of modern life is the worst offender is your web browser. I wasn't about to verify each destination IP so I ended up blanket allowing the binary. Fine. Then there's also a bunch of system processes on both operating systems that are overloaded. They do so many things using tiny system or kernel level binaries. In the end I disabled the software on both OS.

cvalka 3y ago

Windows Sandbox and Windows MDAG.