2 ms·

Check pledge/unveil under OpenBSD. You get isolated software yet with freedoms.

• marcosdumay 2y ago
  I've recently packed some Linux software in flatpak. It's surprisingly good. Not as good as a real capability-based access control, but quite good compared to the other things that are usable on Linux.
  • pxc 2y ago
    Why are capabilities restrictions not the norm when the concept is so old and seemingly so sound?
    • pjc50 2y ago
      They're really annoying to use. Also the "UNIX ideal" is composable tools, which doesn't combine very well with any kind of sandboxing.
      • marcosdumay 2y ago
        The thing about capabilities is that they compose very well.
    • marcosdumay 2y ago
      Linux doesn't have a good capability system. And no good system makes it into Linux because it has a huge, well supported one, and some 3 other candidates pushing to get there already.
      • pxc 2y ago
        So something crummy but usable-enough for experts (SELinux?) worse-is-better'd its way onto the Linux scene, and now it has matured enough that on the one hand it can't be displaced but on the other its model is ossified and can't be untangled or simplified. Makes sense. I love Linux and many of the fruits of its messy evolution, but such fruits are certainly not all equally delicious. :(