Sandboxing

Let's talk about sandboxing (not containers, not VMs) on normal desktops/workstations. What do you use on what OS and why? Here on GNU/Linux, there are many kernel technologies provided to that effect - user namespaces, seccomp, capabilities - but unlike FreeBSD's jails or Solaris' zones, only a few tools make these accessible to the end user: firejail and bubblewrap. -------------------------------------------------------------------------------- I've used firejail for a long time and still keep it installed because it can be handy when you don't want to spend time or want some advanced features like dbus proxying or X11 sandboxing but I disliked its large setuid code size and retarded problem like not allowing whitelisted paths to contain ! or &, so I decided to switch to bubblewrap and wrote scripts that (for now) work well with with my biggest attack surfaces: mupdf and qutebrowser. https://git.sr.ht/~q3cpma/scripts/tree/master/item/bwrap.bash https://git.sr.ht/~q3cpma/scripts/tree/master/item/bwrap_auto.bash

I'd just like to interject for a moment. What you're referring to as GNU/Linux, is in fact, Linux, or as i've recently taken to calling it, just Linux. GNU is not part of the Linux kernel but rather a third party software, just like systemd or glibc, which happens to be used in most Linux distributions. Android, ChromeOS, and Alpine Linux are all Linux distributions, but none of them contain the GNU core utilities or any other GNU code. They are Linux, but not GNU/Linux.

>>58931 99% of people who say "musl/clang or Android exist" or "let's call it GNU/Apache/X.org/Mozilla/Linux while you're at it" simply don't understand why it is still true. The first reason is that GNU started the idea of a free OS, and provided the GPL as the most important part, not the code. Someone as crazy as rms decided to leave his comfortable job to follow his life's mission of making a UNIX compatible OS free for everyone to use and modify; all the while people were laughing at his self-imposed Sisyphean task. Without him and the people that followed, probably nobody would have tried to seriously replace UNIX, GNU birthed the zeitgeist that started the whole thing rolling. The other reason is that even if code isn't the most important thing, it is still important, and all the boring and sometimes complicated stuff that POSIX/SUS mandates (for example, it took them 4 years to get a complete toolchain) were done by the GNU project and already used long before Linux came to. In his initial Usenet post, Torvalds even says "I've currently ported bash(1.08) and gcc(1.40), and things seem to work" without even batting an eye while saying that he is making his own OS, as if the GNU stuff came from the sky. **This is also a pasta.**

>>58927 I have used bubblewrap once (thanks for the scripts, I might use it more often now). I usually just use qemu or VirtualBox (zealots can install Qubes OS). Docker is okay, too. I think FreeBSD/HardenedBSD/DragonFly BSD jails are better than what other operating systems have (there is a good book about them, called "FreeBSD Mastery: Jails" by Michael W. Lucas). Another option is that you could download a Gentoo stage3 tarball or equivalent, like Void's rootfs tarball: https://voidlinux.org/download/ then unpack it and just chroot into it (just follow the instructions from Gentoo Handbook: https://wiki.gentoo.org/wiki/Handbook:AMD64/Installation/Base#Mounting_the_necessary_filesystems) If you just want to get emerge on another distro, you should use a Gentoo Prefix instead: https://wiki.gentoo.org/wiki/Project:Prefix Linux capabilities are ok, but OpenBSD's pledge/unveil are better (easier to use and they make more sense). A thing to note about capabilities is that they certainly aren't a silver bullet: https://lwn.net/Articles/280279/ https://forums.grsecurity.net/viewtopic.php?f=7&t=2522

>>58935 >thanks for the scripts, I might use it more often now Beware, probably very setup dependant. >I usually just use qemu or VirtualBox (zealots can install Qubes OS). Docker is okay, too Heavy when I just want to open a PDF. And it's a waste to not use all those cool Linux features (USER_NS especially). >FreeBSD/HardenedBSD/DragonFly BSD jails are better than what other operating systems have Why? Except being integrated and available in base. Did Dfly ever port capsicum? Is there an equivalent to user namespaces/unveil in those? >nother option is that you could download a Gentoo stage3 tarball or equivalent, like Void's rootfs tarball: https://voidlinux.org/download/ then unpack it and just chroot into it Chroot isn't a real security mechanism, though. >Linux capabilities are ok, but OpenBSD's pledge/unveil are better (easier to use and they make more sense). No. Functionally, both seccomp and capsicum are a superset of pledge and have the advantage of automatically being applied to subprocesses. Pledge has some cool features like incremental privilege dropping, but it's still a dumbed down replacement for both full featured capabilities and syscall filtering. Both pledge and unveil also suffer from two problems: 1) OpenBSD still doesn't have any jail-like tool using those, mandating very painful source code modification for the whole port tree. 2) No integration with posix_spawn, which, coupled with the aforementioned lack subprocess inheritance is a glaring hole.