If no, it can't do things like "rotate", "strip exif data", or whatever other basic manipulation functions you might want. If no, you will probably run into files it can't read.ĭo you want your image viewer to be able to write to files? If yes, it can do immeasurable damage. I simply want to prevent a simple vulnerability in my image viewer or media player to allow malware to take over my whole system.ĭo you want your image viewer to be able to read all your files? If yes, it can read all your files. If you want to combine those two, you need to accept that sometimes things will randomly break, and that you may need to change or write rules for what actions a given program is allowed to perform. Meanwhile, you're asking for a security layer that will block and/or break a bunch of system calls that you don't want to have happen.
#REDDIT SANDBOXIE SOFTWARE#
You have a piece of software that was written with the assumption that all system calls work normally. Maybe its not possible to use an effective sandbox that is also convenientīasically, yeah. The best Solution I found until now seems to be bubblewrap scripts like the ones found here and accept that some application features are restricted. I simply want to prevent a simple vulnerability in my image viewer or media player to allow malware to take over my whole system.Īre there any solid solutions out there that are actually easy to use? I'm not looking for something like SELinux/Apparmor or anything that requires me as the end user to have any deeper knowledge about the topic. There seem to be some solutions that try to implement sandboxing on Linux like Flatpak and Firejail, but they are also heavily criticized by the security community for their approach.įirejail runs as suid root and had several vulnerabilities because of this, while flatpak is mostly designed for application distribution and the sandbox is regularly demonstrated as ineffective.
#REDDIT SANDBOXIE ANDROID#
The default security model on Linux separates between users but not between applications/processes like on Android or iOS.
0 kommentar(er)
