Re:Bubblewrap – Low-level unprivileged sandboxing tool used ...
by nextos on Tuesday July 11, 2023 @10:33PM
(#36689802)
In practice, mainstream distributions do not offer ready-to-use zero-conf sandboxing for userland applications.
There are of course exceptions, like those using Flatpak, but what I would like to see is Firejail/bwrap applied to all binaries, with sane defaults.
In other words, if I run python or Firefox and they get compromised, they should not be able to read e.g. ~/.ssh and steal my private keys (unless I gave them permission to).
Nix has done a great work making dependencies declarative and reproducible, I would also like clean sandboxing as it is an equally important issue.
There are of course exceptions, like those using Flatpak, but what I would like to see is Firejail/bwrap applied to all binaries, with sane defaults.
In other words, if I run python or Firefox and they get compromised, they should not be able to read e.g. ~/.ssh and steal my private keys (unless I gave them permission to).
Nix has done a great work making dependencies declarative and reproducible, I would also like clean sandboxing as it is an equally important issue.