6 ms·

If you want raw access to devices, X11, etc, then it is not so simple. The media players I use talk to Pulseaudio, not directly to audio. Various of your needs

by bkor 12y ago

If you want raw access to devices, X11, etc, then it is not so simple. The media players I use talk to Pulseaudio, not directly to audio. Various of your needs go pretty much against sandboxing. It's much easier to focus first on applications instead of these needs. For instance, fully sandboxing and X11 won't work anyway. It seems pretty impossible to create something which: 1) does sandboxing 2) has no limitations on what an application can do Edit: What I meant is: Is it possible to lower your requirements or change how VLC works/can do when it is sandboxed?

jbk 12y ago
> Is it possible to lower your requirements or change how VLC works/can do when it is sandboxed? Maybe for some, but not for others. You really need to be able to open a file without file opener. Opening optical disks is really important too. I don't get why read-only access to a device poses so much threats but I'm probably missing something. FYI, so far, libpulse links to x11.
- sp332 12y ago
  Low-level access to a device would let you read data from files that you don't have permission to read at the filesystem level.
  - asveikau 12y ago
    You can set different permissions for different devices, you are aware of that right? I can say my DVD drive is readable by gid x, but not the partitions on my hard disk... This is already what Linux distros are doing.
    - edohyiez 12y ago
      Then the media player can read every DVD you put into your drive as long as its running. So you always have to close the media player before inserting a DVD containing private files. That probably isn't that important for DVDs, but for other devices (e.g. microphone, webcam) it certainly is.
- tormeh 12y ago
  >You really need to be able to open a file without file opener What if you had read/write access to /home/user/music and /home/user/video ? Once we start adding blanket access like this we would probably need to add a /home/user/secret folder that no application can access unless invited to a specific file by a file opener.

by bkor 12y ago

jbk 12y ago

> Is it possible to lower your requirements or change how VLC works/can do when it is sandboxed? Maybe for some, but not for others. You really need to be able to open a file without file opener. Opening optical disks is really important too. I don't get why read-only access to a device poses so much threats but I'm probably missing something. FYI, so far, libpulse links to x11.

sp332 12y ago
Low-level access to a device would let you read data from files that you don't have permission to read at the filesystem level.
- asveikau 12y ago
  You can set different permissions for different devices, you are aware of that right? I can say my DVD drive is readable by gid x, but not the partitions on my hard disk... This is already what Linux distros are doing.
  - edohyiez 12y ago
    Then the media player can read every DVD you put into your drive as long as its running. So you always have to close the media player before inserting a DVD containing private files. That probably isn't that important for DVDs, but for other devices (e.g. microphone, webcam) it certainly is.
tormeh 12y ago
>You really need to be able to open a file without file opener What if you had read/write access to /home/user/music and /home/user/video ? Once we start adding blanket access like this we would probably need to add a /home/user/secret folder that no application can access unless invited to a specific file by a file opener.