First fully sandboxed Linux desktop app

jeremy · 02-17-2015, 09:03 AM

Quote:

Its not a secret that I’ve been working on sandboxed desktop applications recently. In fact, I recently gave a talk at devconf.cz about it. However, up until now I’ve mainly been focusing on the bundling and deployment aspects of the problem. I’ve been running applications in their own environment, but having pretty open access to the system.

Now that the basics are working it’s time to start looking at how to create a real sandbox. This is going to require a lot of changes to the Linux stack. For instance, we have to use Wayland instead of X11, because X11 is impossible to secure. We also need to use kdbus to allow desktop integration that is properly filtered at the kernel level.

Recently Wayland has made some pretty big strides though, and we now have working Wayland sessions in Fedora 21. This means we can start testing real sandboxing for simple applications. To get something running I chose to focus on a game, because they require very little interaction with the system. Here is a video I made of Neverball, running in a minimal sandbox:

Visit the GNOME Blog for more...

What do LQ members think of Linux sandboxing?

--jeremy

Myk267 · 02-18-2015, 11:37 PM

I think sandboxing is going to be huge, not just for users but distributions as well.

fatmac · 02-19-2015, 04:24 AM

Quote:

We also need to use kdbus to allow desktop integration that is properly filtered at the kernel level.

Does this mean another enforced 'system modification' like systemd(!?).

*BSD - here we come.....