4 ms·
Unix permissions were written at a time where the (multi user) system was protecting itself from the user. Every program ran at the same privileges of the user,
by nextaccountic 9mo ago
Unix permissions were written at a time where the (multi user) system was protecting itself from the user. Every program ran at the same privileges of the user, because it wasn't a security consideration that maybe the program doesn't do what the user thinks it does. That's why in the list of classic Unix tools there is nothing to sandbox programs or anything like that, it was a non issue
And today this is.. not sufficient. What we require today is to run software protected from each other. For quite some time I tried to use Unix permissions for this (one user per application I run), but it's totally unworkable. You need a capabilities model, not an user permission model
Anyway I already linked this elsewhere in this thread but in this comment it's a better fit https://xkcd.com/1200/ https://xkcd.com/1200/
- fsflover 9mo agoThis is why my daily driver is https://qubes-os.org https://qubes-os.org
- theteapot 9mo agoI feel like apparmor is getting there, very, very slowly. Just need every package to come with a declarative profile or fallback to a strict default profile.
- curt15 9mo ago>And today this is.. not sufficient. What we require today is to run software protected from each other. For quite some time I tried to use Unix permissions for this (one user per application I run), but it's totally unworkable. You need a capabilities model, not an user permission model Unix permissions remain a fundamental building block of Android's sandbox. Each app runs as its own unix user.
- surajrmal 9mo agoAndroid sandboxing works in spite of the underlying security model, not because of it. It's also really selinux that does a lot of heavy lifting.
- goodthenandnow 9mo agoSubthread from a while ago where I wrote some details on how Android sandboxing architecture uses Linux’s primitives: https://news.ycombinator.com/item?id=40676309 https://news.ycombinator.com/item?id=40676309
- nextaccountic 9mo agoI really want a desktop distro that is based on Android but can run normal desktop apps, fully isolated by default Can Binder run on desktop, with some non-mainline kernel? Is someone maintaining such kernel with up to date patches?
- nesarkvechnep 9mo agoThere's FreeBSD's Capsicum. It's a full-blown sandboxing mode and capability framework. Unfortunately, Linux didn't adopt it and chose chaos.
- mike_hearn 9mo agoYes but systemd is a full blown sandboxing system, and he said the two working in concert.