Do, or do not. There is no try

Re:Do, or do not. There is no try by cookiengineer on Saturday June 24, 2023 @04:12PM (#36462281)

I can recommend reading the systemd manual entries (e.g. man systemd.exec).

SystemD meanwhile has a lot of options for managing a seccomp based sandbox, e.g. various protect options for the filesystem, mounting critical things as read-only, simulating a chroot with its own fake-root user etc.pp.

You can also manage the capabilities of a binary from there, so it's actually integrated down the kernel stack.

However, as you mentioned, the lack of an official "profile database" for common packages/software makes it just as useless as the other tools.

I wish we had a repo where all the things come together and people can just do something like "autosandbox apache2" and it will do the rest.

[ Parent | on HN ]

Re:Do, or do not. There is no try by throwing_away on Saturday June 24, 2023 @05:15PM (#36462723)

Thanks. I'm learning about this today and I'm beginning to suspect all the extra isolation software is not really useful if you configure AppArmor and SystemD properly per service.

The space between "full virtual machine" and "unix permission model" is vast and confusing.

I would have thought that because everything is hashed on nix, it would be trivial to spin up full "virtual machines" without consuming mountains of disk space, but that does not seem to be an option.

[ Parent | on HN ]

Re:Do, or do not. There is no try by progval on Sunday June 25, 2023 @03:30AM (#36465798)

Firejail does this. The profile database is the two "profile" directories in https://github.com/netblue30/firejail/tree/master/etc

[ Parent | on HN ]

Re:Do, or do not. There is no try by D_Sam on Sunday June 25, 2023 @05:18AM (#36466317)

Sorry… I see no other way to contact you. I saw here in one of your previous comments that you were able to put 32gb of memory on a T440p… can you tell how!? If possible please dm me. Thanks.

[ Parent | on HN ]