Hacker News Reader

Comment by ohazi | Hacker News Reader

To me, user accounts have always seemed like the more reasonable approach to sandboxing vs. cloning the universe to run a single program in a container.

Most of my systems have a user for myself, and one or two other users like `sketchy` or `test` or something for programs that I trust enough to run, but don't trust enough to not fuck up my home directory in some way (including modifying startup scripts, which IMHO should probably require sudo to edit, even for a normal user).

If the program is really sketchy and you're worried about it doing something like exfiltrating ~/Documents/taxes, then private home directories would definitely seem like a good default. You can always have an explicitly shared area like /home/shared/$user that defaults to public.

View on HN

I run such less trusted programs on other machines. The privilege elevation attack surface is just too big on a normal Linux system.

That's why I think intra-user isolation is better. I would feel so much better if my browser could just access its settings, the download directory, and read access outside my home directory (for libs and such).

> I would feel so much better if my browser could just access its settings, the download directory, and read access outside my home directory (for libs and such).

I regularly have to both download files to other directories than my Download folder and upload files from other directories, such a restriction would break a lot of existing use cases.

The optimal way to achieve this would be to have the file / save picker a completely separate process, which then passes a token to the browser, which the browser then exchanges at some sort of "broker" process that returns a handle to the file.

Isn't SELinux supposed to provide exactly this functionality?

The tricky part are the profiles afaik. But this could be solved with some concentrated community effort I guess.

I think AppArmor does something similar (I don't know the differences to SELinux in detail, so if someone like to clarify please go ahead). I remember I've seen some AppArmor related stuff regarding Firefox (and LibreOffice I think) in Ubuntu. So seems not much is missing to have at least an sandboxed web browser out-of-the-box on a Linux desktop.

SELinux can and does do exactly this, depending on the configuration. What you'll most often see is that applications covered will have rules that allow it to access a subset of the user's home content (xdg cache, data, etc.) that allow that application to function, and SELinux will use UBAC rules to ensure that user A's instance of that application cannot access the data of user B's.

Profiles are indeed tricky though, and generally something I would consider more easily implemented as just logging in as a different user.

I can't speak much about AppArmor since I'm not too familiar with it.

SELinux can do this--think of it as a second layer of security that is checked after the normal DAC checks (e.g., process uid vs file permissions) succeed.

Easiest way to do it is to install via Flatpak, e.g. for Chromium with only access to the Downloads directory:

  sudo flatpak remote-add --if-not-exists flathub https://dl.flathub.org/repo/flathub.flatpakrepo
  sudo flatpak install -y flathub org.chromium.Chromium
  sudo flatpak override org.chromium.Chromium --nofilesystem=home --filesystem=$HOME/Downloads

> I run such less trusted programs on other machines.

You could probably use Qubes OS instead.

I tried that for a while. Don't remember why I gave up, but it could have been abysmal youtube performance or laptop suspend issues.

It's been a while, though. But now I'm also spoiled with Sway. Haven't checked if I can keep Sway on qubes.

Agree, users are a good start, also systemd for example provide ways to run a process on its own file system too, readonly, etc... I guess virtualization or containers is needed because of the unknowns bugs, bad use of technology and /or not being able to harness a system very well with non sandboxing methods.

Me too, I have on each system at least 6 users just for myself. I'm also an Ubuntu user at moment, and I change also the access rights for the home directory just for the user each time. I used SuSE before and they allways had just user access for the user.

Reply on news.ycombinator.com