Beware of sudo on OS X

Re:Beware of sudo on OS X by rsy96 on Monday August 17, 2015 @01:03AM (#10071444)

Maybe we should have easy to use sandbox commands controlled by the user. Currently all the software must be designed and compiled with sandbox restrictions deliberately (e.g. Chrome). It is better if we can sandbox arbitrary programs with convenience.

[ Parent | on HN ]

Re:Beware of sudo on OS X by comex on Monday August 17, 2015 @04:50AM (#10071898)

CLI is one thing, but for GUI apps, OS X has supported sandboxing for years, enforcing it on all Mac App Store apps against developer outcry.

On Linux, GNOME is working on something that looks quite a bit like how OS X did it:

https://wiki.gnome.org/Projects/SandboxedApps

So I think we're actually moving in the right direction, albeit extremely slowly and imperfectly.

[ Parent | on HN ]

Re:Beware of sudo on OS X by rsy96 on Monday August 17, 2015 @11:27PM (#10077470)

The problem with Mac App Store sandboxing is that it is not configurable and therefore many apps are simply unusable or extremely annoying sandboxed.

[ Parent | on HN ]

Re:Beware of sudo on OS X by exprP on Monday August 17, 2015 @03:11AM (#10071659)

Don't we have that? With SELinux, sandboxing is literally a command away (and the command is, aptly, named `sandbox´).

There are certain inconveniences when it comes to sandboxing applications, especially applications that require an X server, which is why sandboxing is not done by default on any popular Linux OS.

[ Parent | on HN ]

Re:Beware of sudo on OS X by okasaki on Monday August 17, 2015 @02:54AM (#10071633)

Why does it need to be user controlled?

Someone creates a sandbox profile for a program and then distributes it to others.

[ Parent | on HN ]