System-wide sandboxing framework - sandbox-app-launcher

[madaidan]

@FrozenCat

I want to be able to send notifications from a user cronjob to a sandboxed sway session with its own dbus session. Have you thought of a way other than setting up a passwordless sudo command for each command? Perhaps, I should start a cron daemon from sway?

Not sure.

@FrozenCat

What about using ALSA in a sandbox?

It should work but it’s currently untested. Please try it if you can and report back.

@HulaHoop

How is an older codebase than pulseaudio supposed to be a better idea?

ALSA is still actively updated and isn’t the bane of sandboxes unlike PulseAudio.

Advanced Linux Sound Architecture (ALSA) project

I’d suggest that Whonix remove PulseAudio entirely but that’d be for a separate thread.

@FrozenCat

unix:abstract=/tmp/dbus-HSBQCNgTjD,guid=2429fa577f9384ff718d3ba25fa1fa63

We mount an empty tmpfs over /tmp. Anything in /tmp outside of the sandbox cannot be accessed from within.

@Patrick

I didn’t push the boundaries of sandbox-app-launcher / bubblewrap yet but it could be that things as complex as window managers (or virtualizers) could be out of scope.

Yes, this is more geared towards end-user applications, not any system software.

@Patrick

Could sandbox-app-launcher / bubblewrap be used nested?

bubblewrap can be nested only if using user namespaces. Otherwise, if using setuid, it will disable itself with no_new_privs.

@Patrick

Can Linux do atomic file copy (to /etc/sudoers.d folder)?

Can’t we just write to /tmp and copy it over?

@FrozenCat

Does every program need to be sandboxed as its own user?

Yes. Sandboxing programs running as the same user has historically, never seriously worked well. It’s been the cause of many issues with e.g. Flatpak. It’s why Android/iOS have always used separate users.