3 ms·
I'm immediately skeeved out by any SUID root executable claiming to be secure. Surely there's a way to do this without root perms?
by duped 3y ago
I'm immediately skeeved out by any SUID root executable claiming to be secure. Surely there's a way to do this without root perms?
- 5e92cb50239222b 3y agobubblewrap does this and has been used by flatpak for years. firejail has a lot more features though (which is questionable for a security-critical application, sure), like setting up separate iptables rules, which you would have to do manually with bubblewrap.
- rkeene2 3y agoIf you want something different, but aren't as concerned about performance you can use User-Mode Linux to do this, which I used to use to isolate package building as well as working around bugs in BtrFS. I have a simple script here [0] (though it relies on some setup here [1]). Although I haven't looked back at it for a bit (2016). [0] https://rkeene.org/viewer/tmp/fakeroot.sh.htm https://rkeene.org/viewer/tmp/fakeroot.sh.htm [1] https://rkeene.org/viewer/tmp/fakeroot.Makefile.htm https://rkeene.org/viewer/tmp/fakeroot.Makefile.htm
- yjftsjthsd-h 3y agoYes, buuut the way to do it without root is user namespaces, which have a history of causing their own security problems because the kernel historically assumed that the root user wasn't a threat and only root could access certain interfaces that just got exposed to any user who wanted them. It's getting better with time, thankfully.