News for hackers. Stuff that matters.

A comment on The Linux Security Circus: On GUI Isolation (2011). Parent comment

Re:The Linux Security Circus: On GUI Isolation (2011) by drdaeman on Saturday March 05, 2016 @12:12PM (#11230050)
It's not that simple, and it's easy to misdesign such API.

Say, VLC team had argued that a video player may need to open a supplementary subtitle file. If application can be only granted access to a single video file - that's impossible. I think there were other examples, but I don't remember those off-hand.

[ Parent | on HN ]
Re:The Linux Security Circus: On GUI Isolation (2011) by nine_k on Saturday March 05, 2016 @01:15PM (#11230280)
Filesystems are trees. VOX could have read access to a particular tree (~/Videos) and no access to everything else, including but not limited to ~/Documents/Finance
[ Parent | on HN ]
Re:The Linux Security Circus: On GUI Isolation (2011) by drdaeman on Saturday March 05, 2016 @08:19PM (#11232013)
But what if I want to watch ~/Downloads/big_buck_bunny.mkv?
[ Parent | on HN ]
Re:The Linux Security Circus: On GUI Isolation (2011) by nine_k on Sunday March 06, 2016 @01:51PM (#11234933)
Explicitly mark it as available by moving / hardlinking it to ~/Videos.
[ Parent | on HN ]
Re:The Linux Security Circus: On GUI Isolation (2011) by marcosdumay on Saturday March 05, 2016 @04:24PM (#11231157)
It's certainly not simple. This is a big UX problem, but one worth solving.
[ Parent | on HN ]