Hacker News Reader

>Also, @cgwalters thinks trying to whitelist file paths is a bad idea given the myriad ways users have to manipulate paths, and the myriad ways in which system administrators may configure a system.

So you either get the entire filesystem or no file access? Isn't this a huge dealbreaker for almost everything?

View on HN

I think this is just a comment on Firejail's implementation, as I think Firejail runs as root and thus must enforce its own permission checks.

It seems like bubblewrap uses a mount namespace created by the current user which would allow controlling access without any special checks.

I'm running firejail now and It doesn't look like it runs as root.

Correct, it is an SUID executable[0], as is bubblewrap.

[0]: https://en.m.wikipedia.org/wiki/Setuid

This is poorly documented, but if the kernel supports unprivileged user namespaces, bubblewrap works without suid.

Good to know, thanks.

Does/can firejail, or is that a difference?

bubblewrap is only setuid if user namespaces are unavailable.

Better to use selinux than path whitelisting.

Reply on news.ycombinator.com