News for hackers. Stuff that matters.

A comment on Secure Containerized Browser.

Re:Secure Containerized Browser by em3rgent0rdr on Wednesday December 15, 2021 @09:48PM (#29574242)
Isn't restricting chromium to only ~/Downloads already possible in a regular Linux OS by running chromium inside a chroot?
[ Parent | on HN ]
Re:Secure Containerized Browser by tyingq on Wednesday December 15, 2021 @10:24PM (#29574427)
Perhaps, though with a fair amount of hassle giving it access to device files, shared libraries, dynamically loaded plugins, and so on.
[ Parent | on HN ]
Re:Secure Containerized Browser by yjftsjthsd-h on Wednesday December 15, 2021 @10:58PM (#29574628)
The easy option is firejail, which ships with premade profiles to give things exactly what they need to run, ex. https://github.com/netblue30/firejail/blob/master/etc/profil...
[ Parent | on HN ]
Re:Secure Containerized Browser by tyingq on Wednesday December 15, 2021 @11:03PM (#29574664)
Sort of. For example:

https://github.com/netblue30/firejail/issues/1950

There are other, similar issues. It's a fair amount of work sussing it all out.

[ Parent | on HN ]
Re:Secure Containerized Browser by tata71 on Wednesday December 15, 2021 @10:42PM (#29574527)
You'd use a portable build.
[ Parent | on HN ]
Re:Secure Containerized Browser by DarylZero on Thursday December 16, 2021 @12:28AM (#29575268)
Not really, since ~/Downloads isn't inside a chroot. You accomplish it most easily with AppArmor.

Anyway, OP is telling you how to do it with OpenBSD, which is also a "regular" OS.

[ Parent | on HN ]