News for hackers. Stuff that matters.

A comment on Bubblewrap – Low-level unprivileged sandboxing tool used by Flatpak. Parent comment

Re:Bubblewrap – Low-level unprivileged sandboxing tool used ... by totallywrong on Tuesday July 11, 2023 @08:41PM (#36689054)
> sandboxing is pretty important and an area were Linux distributions are falling behind macOS

How so? Linux has cgroups, namespaces, containers, and things like Flatpak. And these days rootless containers (where you can set even the allowed syscalls) are good for most use cases too.

[ Parent | on HN ]
Re:Bubblewrap – Low-level unprivileged sandboxing tool used ... by nextos on Tuesday July 11, 2023 @10:33PM (#36689802)
In practice, mainstream distributions do not offer ready-to-use zero-conf sandboxing for userland applications.

There are of course exceptions, like those using Flatpak, but what I would like to see is Firejail/bwrap applied to all binaries, with sane defaults.

In other words, if I run python or Firefox and they get compromised, they should not be able to read e.g. ~/.ssh and steal my private keys (unless I gave them permission to).

Nix has done a great work making dependencies declarative and reproducible, I would also like clean sandboxing as it is an equally important issue.

[ Parent | on HN ]
Re:Bubblewrap – Low-level unprivileged sandboxing tool used ... by imglorp on Wednesday July 12, 2023 @12:43AM (#36690550)
> Firejail/bwrap applied to all binaries, with sane defaults

Isn't that kinda SELinux in the limit?

[ Parent | on HN ]