Re:Goodbye Mac App Store
by oneeyedpigeon on Saturday March 11, 2017 @05:23AM
(#13844995)
Wouldn't an application-specific user account (mostly) solve that problem without having to resort to a more complicated access control model?
Then you have to fiddle when you want the application to read/write a file in your home directory. So, then either the application has blanket access again or the user has to manager per-file groups or ACLs.
Re:Goodbye Mac App Store
by oneeyedpigeon on Saturday March 11, 2017 @08:14AM
(#13845318)
So a text editor gets the user's permissions, a game that writes a local save file has its own permissions ... what's an example app that wouldn't be able to work this way?
Although strictly true, Unix DAC is a security model that stems from the 60/70ies. When a malicious actor gets read (or write) access to your home directory, it is pretty much game over (think cryptolocker, identity theft, loss of sensitive files, etc.). With vulnerabilities in internet-facing software being a fact of life, you want compromises to be restricted to their own little sandbox, not all the files in your home directory.