3 ms·

Whilst I like getting more control of my hardware, I really prefer if I can contain arbitrary software - sandbox it and compartmentalise it. If arbitrary proces

by eptcyka 2mo ago

Whilst I like getting more control of my hardware, I really prefer if I can contain arbitrary software - sandbox it and compartmentalise it. If arbitrary processes can own your whole system, is anyone truly an owner?

rep_lodsb 2mo ago
This requires access to hardware registers, so it won't work as non-root or inside a VM.
fsflover 2mo ago
So you might like Qubes OS, which isolates all apps into hardware-assisted VMs. You will still have all the access from the AdminVM, but arbitrary processes won't.
- eptcyka 2mo ago
  I am using Qubes already ;^)
  - fsflover 2mo ago
    So you've got nothing to worry about except things like this: https://forum.qubes-os.org/t/qsb-116-multiple-xen-issues-xsa-500-xsa-505-xsa-506-xsa-507/42672/2 https://forum.qubes-os.org/t/qsb-116-multiple-xen-issues-xsa...
VorpalWay 2mo ago
You probably misunderstood the technical writeup (if you read it). This is modifying MMIO registers of the DRAM controllers. Normal user space (ring 3) doesn't have access to that. Nor does a VM guest. This needs host kernel level access to begin with. And that is the layer that should be in complete control of the system. There shouldn't be a hidden OS underneath that I can't replace.