Re:Bubblewrap – Low-level unprivileged sandboxing tool used ...
by remexre on Wednesday July 12, 2023 @12:59AM
(#36690632)
I think that still requires lots of work, since lots of programs expect to be able to pass around paths to children/parents and have those paths remain openable.
For instance, if both cmake and ld get their own sandboxes, with their own view of /lib, it seems pretty likely that cmake's -L flags will get mixed up, in a way that's harder to debug than "oh, CMake passed -L/lib/foo; nothing should use /lib, so I need to find where that's hardcoded."
Re:Bubblewrap – Low-level unprivileged sandboxing tool used ...
by awegio on Wednesday July 12, 2023 @05:21AM
(#36692118)
> put programs in custom sandboxes, where /bin/bash is found exactly where they expect to find it
NixOS can do that, I think it was necessary to get Steam games running
https://nixos.org/manual/nixpkgs/stable/#sec-fhs-environment...
Nix seems to have to put lots of work into handling programs that expect to find to find /bin/bash. An alternative would be to put programs in custom sandboxes, where /bin/bash is found exactly where they expect to find it.