4 ms·

This is a waste of time compared to investing in sandboxing which will actually protect users as opposed to stopping theoretical attacks. Fedora's sandbox capab

This is a waste of time compared to investing in sandboxing which will actually protect users as opposed to stopping theoretical attacks. Fedora's sandbox capabilities for apps is so far behind other operating systems like Android that it is much more important of an area to address.

johnny22 2y ago
I think you have to do both sandboxing and this.
- charcircuit 2y ago
  Both are good for security, but prioritization is important. The areas that are weakest in terms of security should get the most attention.
  - jcgl 2y ago
    That assumes that there is a fixed amount of effort and resources to be split between the two things—that there is always opportunity cost. When it comes to community efforts, it’s rarely the case that all things have opportunity cost—people who contribute effort for X would not have necessarily done so for Y. The Fedora Project is of course not a purely community effort, so I don’t know exactly how that applies here. But just wanted to point out that prioritization and opportunity cost don’t always work like you suggested.
AshamedCaptain 2y ago
I am yet to see a form of sandboxing for the desktop that is not: a) effectively useless or b) makes me want to throw my computer through the window and replace it with a 1990's device (still more useful than your average Android).
fsflover 2y ago
If you want security through compartmentalization, you should consider Qubes OS, my daily driver, https://qubes-os.org https://qubes-os.org.
- charcircuit 2y ago
  This only secures between vms. This side steps the problem and people can still easily run multiple applications in the same qube.
  - fsflover 2y ago
    It's impossible to isolate applications inside one VM as securely as with Qubes virtualization. You should not rely on intra-VM hardening if you really care about security. Having said that, Qubes does provide ways to harden the VMs: https://forum.qubes-os.org/t/hardening-qubes-os/4935/3 https://forum.qubes-os.org/t/hardening-qubes-os/4935/3, https://forum.qubes-os.org/t/replacing-passwordless-root-with-a-dom0-prompt/19074 https://forum.qubes-os.org/t/replacing-passwordless-root-wit....
    - charcircuit 2y ago
      People may want to have multiple apps work together. It makes sense to have security within a qube itself than to just declare it a free for all.
      - fsflover 2y ago
        If the apps work together, they typically belong to the same security domain / trust level. Do you have examples when you still have to isolate them from each other?
        charcircuit 2y ago
        Even if things are on the same trust level that doesn't mean that if one gets compromised I don't care that it affects the 2nd.
        fsflover 2y ago
        So just run them in different VMs? Apart from that, any hardening in Fedora can be utilized inside a Fedora VM on Qubes. Qubes doesn't force you to use VMs with no isolation inside.
PhilippGille 2y ago
> Fedora's sandbox capabilities for apps Do you mean Flatpaks or something else?
- charcircuit 2y ago
  Sure, that is one solution, but it still needs a lot of work both to patch up holes in it and to fix apps to be better designed in regards to security.
  - microtonal 2y ago
    Don't let perfect be the enemy of good? Flatpak is not perfect, but it has steadily improved security over the years. When I first used Flatpak, most applications had their sandboxes wide-open (because they were not compatible with sandboxing). Nowadays a lot of Flatpaks have much more limited sandboxes.
colonial 2y ago
Defaulting to Android-style nanny sandboxing ("you can't grant access to your Downloads folder because we say so" etc.) is unlikely to go over well with the average Linux distro userbase. Also, maximally opt-in sandboxes for graphical applications have been possible for a while. Just use Podman and only mount your Wayland socket + any working files.
- charcircuit 2y ago
  >Defaulting to Android-style nanny sandboxing ("you can't grant access to your Downloads folder because we say so" etc.) is unlikely to go over well with the average Linux distro userbase. If you market it that way. Plenty of Linux users say they care about security, don't want maleware, etc. This is a step towards those desires. Users have been conditioned to use tools badly to designed for security for decades so there will be some growing pains, but it will get worse the longer people wait. >Just use Podman and only mount your Wayland socket + any working files. This won't work for the average user. Security needs to be accessible.
- amarshall 2y ago
  > Just use Podman and only mount your Wayland socket + any working files. If only it was that simple…
  - yjftsjthsd-h 2y ago
    Why isn't it?
    - amarshall 2y ago
      All files pokes a big hole, really you want portals. You probably also want audio. And perhaps graphics acceleration depending on the software, and other limited hardware access. And dbus (but sandboxed proxy access). Probably some global config from the host as well (fonts, themes, cursor). And…well maybe there’s more but the point is it depends on the software. Maybe it is that simply sometimes. Often it’s not for non-trivial applications.
preisschild 2y ago
Flatpak, which Fedora Workstation uses by default, is already very similar in capabilities to Android's sandboxing system.

johnny22 2y ago

I think you have to do both sandboxing and this.

charcircuit 2y ago
Both are good for security, but prioritization is important. The areas that are weakest in terms of security should get the most attention.
- jcgl 2y ago
  That assumes that there is a fixed amount of effort and resources to be split between the two things—that there is always opportunity cost. When it comes to community efforts, it’s rarely the case that all things have opportunity cost—people who contribute effort for X would not have necessarily done so for Y. The Fedora Project is of course not a purely community effort, so I don’t know exactly how that applies here. But just wanted to point out that prioritization and opportunity cost don’t always work like you suggested.

AshamedCaptain 2y ago

I am yet to see a form of sandboxing for the desktop that is not: a) effectively useless or b) makes me want to throw my computer through the window and replace it with a 1990's device (still more useful than your average Android).

fsflover 2y ago

If you want security through compartmentalization, you should consider Qubes OS, my daily driver, https://qubes-os.org https://qubes-os.org.

charcircuit 2y ago
This only secures between vms. This side steps the problem and people can still easily run multiple applications in the same qube.
- fsflover 2y ago
  It's impossible to isolate applications inside one VM as securely as with Qubes virtualization. You should not rely on intra-VM hardening if you really care about security. Having said that, Qubes does provide ways to harden the VMs: https://forum.qubes-os.org/t/hardening-qubes-os/4935/3 https://forum.qubes-os.org/t/hardening-qubes-os/4935/3, https://forum.qubes-os.org/t/replacing-passwordless-root-with-a-dom0-prompt/19074 https://forum.qubes-os.org/t/replacing-passwordless-root-wit....
  - charcircuit 2y ago
    People may want to have multiple apps work together. It makes sense to have security within a qube itself than to just declare it a free for all.
    - fsflover 2y ago
      If the apps work together, they typically belong to the same security domain / trust level. Do you have examples when you still have to isolate them from each other?
      - charcircuit 2y ago
        Even if things are on the same trust level that doesn't mean that if one gets compromised I don't care that it affects the 2nd.
        fsflover 2y ago
        So just run them in different VMs? Apart from that, any hardening in Fedora can be utilized inside a Fedora VM on Qubes. Qubes doesn't force you to use VMs with no isolation inside.

PhilippGille 2y ago

> Fedora's sandbox capabilities for apps Do you mean Flatpaks or something else?

charcircuit 2y ago
Sure, that is one solution, but it still needs a lot of work both to patch up holes in it and to fix apps to be better designed in regards to security.
- microtonal 2y ago
  Don't let perfect be the enemy of good? Flatpak is not perfect, but it has steadily improved security over the years. When I first used Flatpak, most applications had their sandboxes wide-open (because they were not compatible with sandboxing). Nowadays a lot of Flatpaks have much more limited sandboxes.

colonial 2y ago

Defaulting to Android-style nanny sandboxing ("you can't grant access to your Downloads folder because we say so" etc.) is unlikely to go over well with the average Linux distro userbase. Also, maximally opt-in sandboxes for graphical applications have been possible for a while. Just use Podman and only mount your Wayland socket + any working files.

charcircuit 2y ago
>Defaulting to Android-style nanny sandboxing ("you can't grant access to your Downloads folder because we say so" etc.) is unlikely to go over well with the average Linux distro userbase. If you market it that way. Plenty of Linux users say they care about security, don't want maleware, etc. This is a step towards those desires. Users have been conditioned to use tools badly to designed for security for decades so there will be some growing pains, but it will get worse the longer people wait. >Just use Podman and only mount your Wayland socket + any working files. This won't work for the average user. Security needs to be accessible.
amarshall 2y ago
> Just use Podman and only mount your Wayland socket + any working files. If only it was that simple…
- yjftsjthsd-h 2y ago
  Why isn't it?
  - amarshall 2y ago
    All files pokes a big hole, really you want portals. You probably also want audio. And perhaps graphics acceleration depending on the software, and other limited hardware access. And dbus (but sandboxed proxy access). Probably some global config from the host as well (fonts, themes, cursor). And…well maybe there’s more but the point is it depends on the software. Maybe it is that simply sometimes. Often it’s not for non-trivial applications.

preisschild 2y ago

Flatpak, which Fedora Workstation uses by default, is already very similar in capabilities to Android's sandboxing system.