You are not logged in.
- Topics: Active | Unanswered
#1 2011-04-18 02:19:35
- Gullible Jones
- Member
- Registered: 2004-12-29
- Posts: 4,863
Maybe dumb idea: poor man's Sandboxie?
If you've been exposed to Windows XP you've probably heard of Sandboxie. Sandboxie, as I understand it, creates a fake environment for an application to run in and write to. The application can't touch the rest of the system (unless someone knows how to hack through the sandbox), and the sandbox can be emptied when the app is closed, deleting anything that got written to the hard drive (except stuff you pulled out of the sandbox).
Well, earlier today I found some stuff on instant system rollback for Linux, using aufs. And a thought struck me... Couldn't the same thing be done for individual applications, instead of the entire system? Using aufs/UnionFS/what have you, how practical would it be to write a script that would isolate a single application from the rest of the filesystem, but allow the retrieval of files by other applications?
Furthermore, is this actually a good idea?
Offline
#2 2011-04-18 02:30:13
- fsckd
- Forum Fellow
- Registered: 2009-06-15
- Posts: 4,173
Re: Maybe dumb idea: poor man's Sandboxie?
It's been attempted a few times before. I think there was a thread here comparing different approaches. All or most, IIRC, made use chroot.
aur S & M :: forum rules :: Community Ethos
Resources for Women, POC, LGBT*, and allies
Offline
#3 2011-04-18 03:45:09
- Stebalien
- Member
- Registered: 2010-04-27
- Posts: 1,239
- Website
Re: Maybe dumb idea: poor man's Sandboxie?
Offline
#4 2011-04-18 13:47:06
- Gullible Jones
- Member
- Registered: 2004-12-29
- Posts: 4,863
Re: Maybe dumb idea: poor man's Sandboxie?
Oh thanks. I thought there were issues with using chroots as jails on Linux though? IIRC if someone gets root access within the chroot, there are ways to easily do a second chroot back into the real system. Has that changed in more recent Linux versions, or does Sandfox rely on using a limited user within the chroot?
Edit: it relies on using a limited user, and I need to learn to use Google. 
Last edited by Gullible Jones (2011-04-18 14:24:24)
Offline
#5 2011-04-18 16:24:57
- Gullible Jones
- Member
- Registered: 2004-12-29
- Posts: 4,863
Re: Maybe dumb idea: poor man's Sandboxie?
Hmm, problem: starting a sandboxed Firefox session when a non-sandboxed one is already open will result in the new session not being sandboxed. Can this be avoided?
Offline
#6 2011-04-18 16:39:05
- hauzer
- Member
- From: Belgrade, Serbia
- Registered: 2010-11-17
- Posts: 279
- Website
Re: Maybe dumb idea: poor man's Sandboxie?
Try passing -no-remote argument to Firefox.
Make a new profile in Firefox (firefox -P) and then use firefox -P profile -no-remote.
Last edited by hauzer (2011-04-18 16:42:58)
Vanity of vanities, saith the Preacher, vanity of vanities; all is vanity.
What profit hath a man of all his labour which he taketh under the sun?
All the rivers run into the sea; yet the sea is not full; unto the place from whence the rivers come, thither they return again.
For in much wisdom is much grief: and he that increaseth knowledge increaseth sorrow.
Offline
#7 2011-04-18 17:59:32
- Gullible Jones
- Member
- Registered: 2004-12-29
- Posts: 4,863
Re: Maybe dumb idea: poor man's Sandboxie?
Thank you...
And I really like this script. Not in the least because it's very easy to see what it does. I'll have to mess around some more with chroot and mount --bind.
BTW... I notice that you can remount a bound directory read-only, but you cannot mount it initially as read-only; e.g. mount --bind -r /etc /foo/etc will warn you that /foo/etc is mounted read-write, but mount -o remount,ro /foo/etc will make it properly read-only. Is this a bug or a feature? If it's a feature, what's the point?
Offline