3 ms·
Sandboxing a program in Bubblewrap is trivially easy if it's a CLI program that doesn't need network access. Sandboxing a program that needs graphics performan
by mike_hock 3y ago
Sandboxing a program in Bubblewrap is trivially easy if it's a CLI program that doesn't need network access.
Sandboxing a program that needs graphics performance anywhere near 10% of what the hardware is capable of is, at the moment, as we're stuck with X11 and growing gray hair waiting for Wayland to become a viable alternative, literally impossible.
Firejail does provide pre-made solutions like running nested X servers, which can sandbox graphical applications at insane resource costs, such that you might as well just run a full virtual machine.
Mount namespaces are security theater if you're giving access to X11, Pipewire, the SSH agent, the GPG agent, the dbus session bus, and god knows what else.
- fruitreunion1 3y agoHow effective do you think the access control mechanisms in Wayland/PipeWire will be? I'm not sure how widely used they are right now but it seems like a step in the right direction rather than allowing all Wayland clients all the privileged extensions (screen recording, input methods) nullifying most security benefits over X11. Also xdg-dbus-proxy exists for dbus though its security depends on what peers you allow it to talk to.
- bandrami 3y agoOTOH it is amusing to watch Wayland re-adopt, one piece at a time, all the "cruft" they started the project to get away from. Embedding will probably be next.
- chlorion 3y agoWayland works okay for me so far! All you need to do is share the compositors socket and /dev/dri with the "container" and it "just works" for me! I do not have xwayland enabled either, all of the software I use is wayland native!