Conversation

Replying to

Snap permissions are generally automatically enabled and the approval process is primarily by Canonical rather than requesting it from the user: snapcraft.io/docs/permissio It's also designed in a very coarse and problematic way. Not a good system. Still better than Flatpak though.

Permission requests | Snapcraft documentation

Snaps are containerised software packages that are simple to create and install. They auto-update and are safe to run. And because they bundle their dependencies, they work on all major Linux systems...

2

@AlwaysCurious__

Replying to

and

What would it take for Flatpak to be decent?

1

1

Replying to

@AlwaysCurious__

and

My understanding is that it mostly is decent solving the "self-contained app" problem, but has a broken sandbox model tacked on. If you just provide your own sandbox it should be good.

1

Replying to

and

@AlwaysCurious__

It's the failed attempt at providing a privacy/security model that's the problem. It might be better than Snap and other alternatives if you ignore all that. They made it a big part of it though. There are also APIs tied to it. They ported Chromium to using Flatpak sandbox APIs.

1

Replying to

and

@AlwaysCurious__

They ended up building things in a way where they end up requiring applications to target their own APIs but a lot of it is designed poorly. It leaks a ton of weird implementation details and a lot is misguided. They're doing a lot of it without looking at iOS, Android, etc.

1

Replying to

and

@AlwaysCurious__

I think it's pretty silly to basically work towards spending years of work re-creating the Android 4.4.x sandbox and permission model but without most applications actually using it. Also no one to force apps to do yearly migrations to a stricter sandbox / permission model.

1

Replying to

and

@AlwaysCurious__

The Android sandbox and permission model is a dead end, built on NSA Linux rather than namespaces.

2

Replying to

and

@AlwaysCurious__

It does use namespaces. They don't offer a way to do the things that it does with SELinux. SELinux is an implementation detail not expose to app developers. It could be any other LSM. It's just how the fine-grained, hard-wired policy in the OS is written. It's not for app devs.

2

1

Replying to

and

@AlwaysCurious__

The stuff you can do with SELinux or LSMs is not stuff that makes sense to do.

1

Replying to

and

@AlwaysCurious__

Then you give up on being able to filter access to kernel APIs like procfs, sysfs, debugfs, perf events, driver ioctls, etc. along with enforcing the security model between the sandboxes via static policy instead of only being something derived dynamically at runtime from code.

2

Replying to

and

@AlwaysCurious__

The upstream kernel has even rejected having a way to fully disable access to perf events without using an LSM. If you can do it with an LSM, they won't accept security features for it anymore. SELinux is even how you do restrictions on dynamic native code generation, etc.

2:46 AM · Oct 19, 2021Twitter Web App

Replying to

and

@AlwaysCurious__

Restrictions on dynamic native code generation is not a security boundary it's a walled garden market control boundary.

1

Replying to

and

@AlwaysCurious__

And perf events? Seccomp trivially blocks all access.

1

Show replies