3 ms·

JFYI, firejail can do all of that. It can start each application in a separate xserver (giving you a choice from several implementations), deny access to everyt

JFYI, firejail can do all of that. It can start each application in a separate xserver (giving you a choice from several implementations), deny access to everything with whitelisting (or do the reverse — your choice). The profiles are really easy to read and write, and it already covers a lot of popular stuff.

lima 3y ago
Still hoping for something other than Firejail to come along: The way profiles are designed is brittle and an order-dependent override hell, and it's common to use denylists vs. allowlists. Firejail is a setuid binary with tons of attack surface and has had a number of privescs itself[1], unlike something like the lower-level Bubblewrap tool. I'm glad it exists, though - it's the only mature solution other than Flatpak that has proper dbus filtering, among other things. [1]: https://www.cvedetails.com/vulnerability-list/vendor_id-16191/Firejail-Project.html https://www.cvedetails.com/vulnerability-list/vendor_id-1619...