Hacker News Reader

Pretty sure Fedora, being based on Red Hat, has the strongest SELinux policy in place by default, and SELinux is pretty much the best sandboxing option available other than actual virtualization.

View on HN

Yes, but this was about Silverblue and how it implements some additional sandboxing, which it doesn't. SELinux is great, but maintaining it and creating configs is huge amount of work and where on AOSP, every process is strictly confined with SELinux, on Fedora, not so much. Not to mention the additional software the user installs. Not at all comparable to real Android or iOS sandboxing.

Secureblue has entered the chat.

It's generally only initial work to make the policies to maintain a program, maintaining doesn't even really exist unless the program radically changes in some way.

Fedora is notable because any software installed via repositories has a policy written for it, so it is already far more in effect than you might realize.

It's entirely comparable to Android sandboxing because it's part of the foundation of Android sandboxing.

Reply on news.ycombinator.com