News for hackers. Stuff that matters.

A comment on Ubuntu stops shipping Flatpak by default. Parent comment

Re:Ubuntu stops shipping Flatpak by default by bionade24 on Wednesday March 29, 2023 @09:41AM (#35357151)
Afaik they disable filesystem sandboxing, not process namespaces. Still better if programs can't ptrace around, although this is indeed a big issue.

If someone knows why this sandboxing is better/worse than SELinux or AppArmor access rules, can you pls elaborate? I'd really like to know.

[ Parent | on HN ]
Re:Ubuntu stops shipping Flatpak by default by simon_o on Wednesday March 29, 2023 @10:16AM (#35357616)
I'm not comparing sandboxing against SELinux/AppArmor. It's a social problem, not a technical one.

I'm comparing "app developers holding themselves accountable" to "package maintainers dish out consequences for misbehavior".

I have absolutely zero trust in the former, and lots of trust in the latter.

[ Parent | on HN ]
Re:Ubuntu stops shipping Flatpak by default by account42 on Wednesday March 29, 2023 @10:16AM (#35357629)
You don't need any fancy packaging to restrict ptrace: https://www.kernel.org/doc/Documentation/security/Yama.txt
[ Parent | on HN ]