3 ms·
I don't think you need to do anything for macOS. It already has a permission system for filesystem access.
by soraminazuki 1y ago
I don't think you need to do anything for macOS. It already has a permission system for filesystem access.
- OutOfHere 1y agoZero-day exploits for web browsers routinely compromise the entire system, even on MacOS. Even without admin access, the exploit can do significant harm.
- soraminazuki 1y agoThe native permission system still works for limiting filesystem access. As for the kinds of things you're describing, I don't think containerization is an effective enough countermeasure. At least definitely not Docker, which includes a root daemon that can be made to run arbitrary commands. A VM, possibly with some of the host integration features disabled, is a better option but is more costly in terms of setup, usability, and power usage. For many, the cost far exceed the risk.