The Great Suspender: New maintainer is probably malicious

Re:The Great Suspender: New maintainer is probably malicious by the8472 on Sunday January 03, 2021 @12:06PM (#25623031)

This is entirely possible. Either by isolating the application into a network namespace (e.g. via firejail or systemd units), with selinux labels, running the process under a custom gid and various other mechanisms.

[ Parent | on HN ]

Re:The Great Suspender: New maintainer is probably malicious by Triv888 on Sunday January 03, 2021 @01:26PM (#25623725)

Anything is possible, but is it relatively easy to block all apps and keep a whitelist of allowed apps?

[ Parent | on HN ]

Re:The Great Suspender: New maintainer is probably malicious by the8472 on Sunday January 03, 2021 @02:17PM (#25624232)

I have not done that on a desktop but seen it on servers with selinux, each service we added had to be labeled properly to get network access, one extra line in the deployment script. I'm not aware of an GUI tools though, if that's what you're asking. I think that's also the approach android uses to enforce app permissions, they obviously have a gui but that doesn't integrate with normal desktop environments.

[ Parent | on HN ]

Re:The Great Suspender: New maintainer is probably malicious by Triv888 on Monday January 04, 2021 @03:40AM (#25628939)

a single line in a deployment script is as simple as it can get, thanks, I will need to give this a try

[ Parent | on HN ]