4 ms·

Or firejail. Or QubesOS using a dedicated VM. There are options, but it would still be nice if Obsidian had a more robust security model.

by elric 1y ago

johnisgood 1y ago
I have been using firejail for most of these kind of applications, be it Obsidian, Discord, or the browser I am using. I definitely recommend people start using it.
- dotancohen 1y ago
  Sell it to us! Why do you use specifically firejail? There are so many options, from so many different security perspectives, that analysis paralysis is a real issue.
  - johnisgood 1y ago
    I feel like I should keep track of all my comments on HN because I remember writing a lengthy comment on firejail more than once. I cannot keep doing this. :D For user-space, there is usually bubblewrap vs. firejail. I have not personally used bubblewrap, so I cannot comment on that, but firejail is great at what it does. The last comment was about restricting clipboard access to either X11 or Wayland which is possible with firejail quite easily, so if you want that, you can have that. You can do a LOT more with firejail though. https://wiki.archlinux.org/title/Firejail https://wiki.archlinux.org/title/Firejail https://man.archlinux.org/man/firejail.1 https://man.archlinux.org/man/firejail.1
    - wonger_ 1y ago
      FYI you can search your comment history with hn.algolia.com: https://hn.algolia.com/?dateRange=all&page=0&prefix=true&query=johnisgood%20firejail&sort=byDate&type=comment https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...
      - johnisgood 1y ago
        Thank you, exactly what I have been looking for!
    - rufugee 1y ago
      So do you configure firejail to give each app their own separate, permanent home directories? Like "firejail --private=/home/user/firejails/discord discord", "firejail --private=/home/user/firejails/chromium chromium", and so on?
      - johnisgood 1y ago
        I have my own Discord.profile! This is my ~/.config/firejail/Discord.profile[1]: include disable-common.inc include disable-devel.inc include disable-interpreters.inc include disable-shell.inc noblacklist /sys/fs noblacklist /sys/module keep-config-pulse keep-dev-shm name discord apparmor caps.drop all caps.keep sys_admin,sys_chroot netfilter nodvd #nogroups #noinput nonewprivs noroot notv #nou2f #novideo protocol unix,inet,inet6 #shell none disable-mnt private-cache #private-tmp noexec /tmp dbus-user filter dbus-user.talk org.freedesktop.Notifications private-bin Discord,cut,echo,egrep,electron,electron[0-9],electron[0-9][0-9],grep,head,sed,sh,tr,xdg-mime,xdg-open,zsh,gzip,wget,curl,notify-send private-etc alternatives,asound.conf,ca-certificates,crypto-policies,fonts,group,ld.so.cache,ld.so.preload,localtime,login.defs,machine-id,password,pki,pulse,resolv.conf,ssl noblacklist /usr/lib/discord/ whitelist ${HOME}/.config/discord read-write ${HOME}/.config/discord whitelist ${DOWNLOADS} whitelist ${HOME}/.config/pulse/* include whitelist-common.inc include whitelist-var-common.inc include whitelist-run-common.inc include whitelist-runuser-common.inc I have some things commented out but you could probably uncomment most. Some has this, too: disable-mnt private-dev private-cache env http_proxy=socks5://127.0.0.1:9050 env https_proxy=socks5://127.0.0.1:9050 FWIW, once you start whitelisting, it will only have access to those directories and files only, so Discord has no access to anything other than its own directory and ${DOWNLOADS}, which I should probably change. You should check out the default profiles for many programs / apps under directory "/etc/firejail". [1] You run it via "firejail Discord" or "firejail ./Discord" if you name it "Discord.profile".
        rufugee 1y ago
        This is great. Thanks for the detailed reply!
    - lioeters 1y ago
      > bubblewrap vs. firejail In case anyone else is curious, I found the following comparison in bubblewrap's repo. - https://github.com/containers/bubblewrap#related-project-comparison-firejail https://github.com/containers/bubblewrap#related-project-com... I'm gonna try both and see which one I like. Thanks for this info! You're sure living up to your user name there. (:
      - johnisgood 1y ago
        To comment on the Pulseaudio bit from the link: you will want "keep-config-pulse" and "whitelist ${HOME}/.config/pulse/*". > You're sure living up to your user name there. (: You are too kind, thank you!

Or firejail. Or QubesOS using a dedicated VM. There are options, but it would still be nice if Obsidian had a more robust security model.

by elric 1y ago

Or firejail. Or QubesOS using a dedicated VM. There are options, but it would still be nice if Obsidian had a more robust security model.

johnisgood 1y ago

I have been using firejail for most of these kind of applications, be it Obsidian, Discord, or the browser I am using. I definitely recommend people start using it.

dotancohen 1y ago
Sell it to us! Why do you use specifically firejail? There are so many options, from so many different security perspectives, that analysis paralysis is a real issue.
- johnisgood 1y ago
  I feel like I should keep track of all my comments on HN because I remember writing a lengthy comment on firejail more than once. I cannot keep doing this. :D For user-space, there is usually bubblewrap vs. firejail. I have not personally used bubblewrap, so I cannot comment on that, but firejail is great at what it does. The last comment was about restricting clipboard access to either X11 or Wayland which is possible with firejail quite easily, so if you want that, you can have that. You can do a LOT more with firejail though. https://wiki.archlinux.org/title/Firejail https://wiki.archlinux.org/title/Firejail https://man.archlinux.org/man/firejail.1 https://man.archlinux.org/man/firejail.1
  - wonger_ 1y ago
    FYI you can search your comment history with hn.algolia.com: https://hn.algolia.com/?dateRange=all&page=0&prefix=true&query=johnisgood%20firejail&sort=byDate&type=comment https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...
    - johnisgood 1y ago
      Thank you, exactly what I have been looking for!
  - rufugee 1y ago
    So do you configure firejail to give each app their own separate, permanent home directories? Like "firejail --private=/home/user/firejails/discord discord", "firejail --private=/home/user/firejails/chromium chromium", and so on?
    - johnisgood 1y ago
      I have my own Discord.profile! This is my ~/.config/firejail/Discord.profile[1]: include disable-common.inc include disable-devel.inc include disable-interpreters.inc include disable-shell.inc noblacklist /sys/fs noblacklist /sys/module keep-config-pulse keep-dev-shm name discord apparmor caps.drop all caps.keep sys_admin,sys_chroot netfilter nodvd #nogroups #noinput nonewprivs noroot notv #nou2f #novideo protocol unix,inet,inet6 #shell none disable-mnt private-cache #private-tmp noexec /tmp dbus-user filter dbus-user.talk org.freedesktop.Notifications private-bin Discord,cut,echo,egrep,electron,electron[0-9],electron[0-9][0-9],grep,head,sed,sh,tr,xdg-mime,xdg-open,zsh,gzip,wget,curl,notify-send private-etc alternatives,asound.conf,ca-certificates,crypto-policies,fonts,group,ld.so.cache,ld.so.preload,localtime,login.defs,machine-id,password,pki,pulse,resolv.conf,ssl noblacklist /usr/lib/discord/ whitelist ${HOME}/.config/discord read-write ${HOME}/.config/discord whitelist ${DOWNLOADS} whitelist ${HOME}/.config/pulse/* include whitelist-common.inc include whitelist-var-common.inc include whitelist-run-common.inc include whitelist-runuser-common.inc I have some things commented out but you could probably uncomment most. Some has this, too: disable-mnt private-dev private-cache env http_proxy=socks5://127.0.0.1:9050 env https_proxy=socks5://127.0.0.1:9050 FWIW, once you start whitelisting, it will only have access to those directories and files only, so Discord has no access to anything other than its own directory and ${DOWNLOADS}, which I should probably change. You should check out the default profiles for many programs / apps under directory "/etc/firejail". [1] You run it via "firejail Discord" or "firejail ./Discord" if you name it "Discord.profile".
      - rufugee 1y ago
        This is great. Thanks for the detailed reply!
  - lioeters 1y ago
    > bubblewrap vs. firejail In case anyone else is curious, I found the following comparison in bubblewrap's repo. - https://github.com/containers/bubblewrap#related-project-comparison-firejail https://github.com/containers/bubblewrap#related-project-com... I'm gonna try both and see which one I like. Thanks for this info! You're sure living up to your user name there. (:
    - johnisgood 1y ago
      To comment on the Pulseaudio bit from the link: you will want "keep-config-pulse" and "whitelist ${HOME}/.config/pulse/*". > You're sure living up to your user name there. (: You are too kind, thank you!