4 ms·
>During the startup phase of the program, it also needs to read some files outside of that directory -- you can apply the confinement only when that phase is do
by charcircuit 1y ago
>During the startup phase of the program, it also needs to read some files outside of that directory -- you can apply the confinement only when that phase is done.
I would stop here and try and change the design. Apps should always be sandboxed. This requirement is not truly necessary.
- wahern 1y agoThe word, sandbox, is unfortunate and obfuscates alot of practical technical and policy issues involved with managing and dropping privileges. And various solutions are often designed around technical limitations in kernel facilities or and integration friction, especially outside App Store-like contexts. More concretely, how would you refactor a tool like grep? It takes a list of paths on the command-line; how do you expect to "sandbox" itself such that it can only access those paths? By writing a wrapper? Why, when the utility itself could easily use unveil or LandLock to restrict itself? Using grep in a "sandbox", and teaching grep how to drop unnecessary privileges after processing it's arguments are two different things.
- charcircuit 1y agoI would make grep into a library so that other applications like file managers can use it.
- wahern 1y agoWould you externally sandbox the file manager? You may as well just sandbox the entire [virtual] machine at that point. Which is not an unreasonable thing to do, but neither a mutually exclusive approach nor a necessarily better one.
- codethief 1y ago> More concretely, how would you refactor a tool like grep? Don't refactor it. Write a wrapper which runs grep inside a lightweight container and - redirects stdin & stdout/stderr appropriately, - bind-mounts inside the container any files/directories passed as parameters.