3 ms·
We need more selinux and sandbox-exec in daily dev lives. There's no reason to bring a whole new system along just to restrict some access.
by viraptor 1y ago
We need more selinux and sandbox-exec in daily dev lives. There's no reason to bring a whole new system along just to restrict some access.
- adastra22 1y agoDocker is just a shim on kernel isolation APIs. It’s not any different, but better packaged. But irrelevant in this case. I dev on macOS. I’m not aware of any other options.
- viraptor 1y agosandbox-exec. It's not great, but it's usable. https://igorstechnoclub.com/sandbox-exec/ https://igorstechnoclub.com/sandbox-exec/ > It’s not any different It's very different. With docker on Mac you're running a VM which runs a wrapped up complete system that runs your app. With selinux/sandbox-exec you run just your app and can skip the extra packaging needed for docker and mounts. (And get the extra performance)
- internet_points 1y agoAny references to how you use selinux? I've used bwrap and firejail, but I don't feel confident that I'm not leaving holes open?
- viraptor 1y agoHonestly - no. To use selinux you need to commit to actually learning how it works and experimenting a bit. I don't think there's an easier way than reading both redhat (https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/8/html/using_selinux/getting-started-with-selinux_using-selinux https://docs.redhat.com/en/documentation/red_hat_enterprise_...) and NSA (https://www.nsa.gov/portals/75/documents/resources/everyone/digital-media-center/publications/research-papers/configuring-selinux-policy-report.pdf https://www.nsa.gov/portals/75/documents/resources/everyone/...) docs. If you're happy with firejail, make sure you use whitelists only and you'll be 90% there with what's possible to achieve.