Re:Bubblewrap – Low-level unprivileged sandboxing tool used ...
by yjftsjthsd-h on Tuesday July 11, 2023 @07:05PM
(#36688393)
NixOS is a very DIY/build-whatever-you-want system; what more would you want than it being available including the wrapper function to make applications default to running under it? I guess it could be included in the default ISOs if you wanted to showcase it, but given the non-zero friction it adds I'm not sure about the cost/benefit on that.
[ Parent
| on HN ]
Re:Bubblewrap – Low-level unprivileged sandboxing tool used ...
by nextos on Tuesday July 11, 2023 @08:29PM
(#36688976)
I know, I maintain quite a few items in NixPkgs. My point is that Linux distributions are not taking sandboxing seriously compared to mobile or macOS, and this is a big security issue.
E.g., if one runs a compromised binary, such as PyTorch [1], sandboxing as implemented by Firejail or bwrap provides defense in depth. You might be running a compromised binary, but it won't be able to read your entire $HOME and steal your data.
I think NixOS is in a great position to offer seamless integration of one sandboxing framework, thanks to the declarative nature of package derivations. But it'd probably need to support just one framework, as it's a pretty foundational component, just like you can't easily switch from systemd to something else.
[1] https://pytorch.org/blog/compromised-nightly-dependency/