News for hackers. Stuff that matters.

A comment on Flatpak – a security nightmare – 2 years later (2020). Parent comment

Re:Flatpak – a security nightmare – 2 years later (2020) by maffydub on Sunday March 21, 2021 @07:42AM (#26529696)
Can it?

If my application invokes syscalls directly, that wouldn't hit anything interposed using LD_PRELOAD.

[ Parent | on HN ]
Re:Flatpak – a security nightmare – 2 years later (2020) by acka on Sunday March 21, 2021 @08:11AM (#26529836)
Firejail[1] is IMO a good alternative. It handles sandboxing using Linux namespaces and seccomp-bpf.

[1] https://firejail.wordpress.com/

[ Parent | on HN ]
Re:Flatpak – a security nightmare – 2 years later (2020) by ddtaylor on Sunday March 21, 2021 @07:59AM (#26529767)
It will certainly work for the vast majority that are using #include <stdio.h> and more importantly for the various GUI apps that are using GTK/Qt dialogs.
[ Parent | on HN ]
Re:Flatpak – a security nightmare – 2 years later (2020) by maffydub on Monday March 22, 2021 @04:29AM (#26538132)
This is for security, though - you can't just assume it's good enough because it will work for most benign applications - you need to be sure it will work for all applications - benign or malicious!

There are other solutions such as seccomp (as siblings of your post have pointed out) that solve this securely, but LD_PRELOAD won't.

[ Parent | on HN ]
Re:Flatpak – a security nightmare – 2 years later (2020) by cycloptic on Sunday March 21, 2021 @08:02AM (#26529779)
The safest way to do it would be to implement it with seccomp so you unconditionally block those syscalls.
[ Parent | on HN ]