The Linux Security Circus: On GUI Isolation (2011)

Re:The Linux Security Circus: On GUI Isolation (2011) by zanny on Saturday March 05, 2016 @01:35PM (#11230389)

Its called Mandatory Access Control. It has existed for over a decade in the mainline kernel. Ubutnu, Fedora, Suse - everyone but Arch, pretty much - supports one of its implementations.

The problem is more that I do not believe any distro is shipping a default-deny policy. Unknown programs are simply given the kitchen sink rather than having, say, user friendly prompts saying "this program has no access control and wants to open X or use Y, allow?"

But we definitely have the technology, and it does not take any heavy overhead isolation to do it.

[ Parent | on HN ]

Re:The Linux Security Circus: On GUI Isolation (2011) by noinsight on Saturday March 05, 2016 @03:01PM (#11230790)

> everyone but Arch

Arch has a grsec kernel in the repos if you want one...

[ Parent | on HN ]

Re:The Linux Security Circus: On GUI Isolation (2011) by zanny on Saturday March 05, 2016 @05:18PM (#11231344)

And nobody maintains prebaked PaX profiles for Arch, which makes the MAC part much less effective as a security feature.

There are two ways to do MAC - applications (or the distro) provides the profiles, that restrict execution to just what the program will use, and if it ever asks for anything else it should be suspect for exploitation. The other one is where you put your programs in learning mode, and that only hardens you against future exploits, not current ones, and you also lose the protection against untrusted software because by default everything is untrusted and you must trust everything on a case by case basis.

[ Parent | on HN ]