Hi,
The idea is really great in my opinion, but any kind of sand boxing is a complex subject to any entry-level user, although necessary to avoid APTs. We should make it easy out of the box.
The problem I see is having to restart or lose user sessions in order to access the untrusted-user.
I don’t know if it’s possible or maybe is kind of per-application sandboxing. But I think the best would be to be able to run the unstrusted-user without having to close the user session. Like run the untrusted-user into the user environment but with so limited access, with independent home folder.
Just imagine you are using the main user, you have multiple apps opened, you are in a video call and you need to open a secured browser for access some websites you don’t really trust at all. Be able to run the browser or any other app in the user session but with the untrusted-user permissions, and the application only with access to the /home/untrusted-user/ but not to /home/user/.
Something like:
Log in in the unstrusted-user, download different applications, like the browser or any other close source app (unsecured), like discord/spotify, fill a list of installed apps with the path of them.
And later onto the user session, execute something like open-untrusted-user and after that a list of applications able to run with untrusted-user.
—————————— Select the application you want to run with low permissions —————————— 1. Browser → source of the bin with the permissions of unstrusted-user 2. Spotify → source of the bin with the permissions of unstrusted-user ……
The unstrusted-user don’t have permissions to read or write in the user’s folders or daemons, like happen with the sysmaint user
I hope I have explained myself well; it’s difficult for me.
Agreed. Introducing yet another boot mode with a new user type would be a bad user experience, and while we had to introduce a new boot mode to make the sysmaint privilege level safe, I don’t think we’ll need to do that here. My hope is to have the sandbox application provide a UX similar to a virtualization app like VirtualBox. It can then allow applications in the sandbox to run side-by-side with applications in other sandboxes and unsandboxed applications.
I like your explanation a lot I think the UX will hopefully be even better than the already good suggestion you have here. Ideally one should be able to open the sandboxer application, click on a sandbox they’ve created, open a terminal in the sandbox, and run sudo apt install whatever, installing the new application into the sandbox. Or, if the user has installed a GUI package manager like Synaptic into the sandbox, they can click a sandbox, click to open Synaptic, find the app they want, and install it that way. Then they wouldn’t need to log out even to install applications.
We’ll probably draw inspiration from Qubes OS for this, since the idea above is essentially “Qubes OS, but minus a lot of the more complicated features, and implemented using containerization rather than VMs”. It won’t be nearly as feature-rich as Qubes at least to start with, and it won’t be able to match Qubes in terms of security, but for users who don’t use Qubes, or for users who want better security within an individual Qube, it should still help a lot.
I was going to say something like that with UI, but I figured that would be a lot of work.
But that was the idea I had in my mind, a sandboxer application where you could install other apps and run them into the main user, but with a sanboxing at user level, not application level as other sanboxers do and we know aren’t secure and optimous at all. Like termux in Android, is like a sandboxed terminal that run into an app but without root permissions
We should find something intermediate between good security, good performance and user friendly. I don’t use qubeos for the overhead it have, is actually difficult to use it in a low resource pc (in my opinion).
If this feature is implemented I would use it for example for close source applications that I use daily, like Discord, and I don’t trust anything. Don’t allow discord to access my files and daemons/bus of my main user, etc. It would be great
I think the UX will hopefully be even better than the already good suggestion you have here. Ideally one should be able to open the sandboxer application, click on a sandbox they’ve created, open a terminal in the sandbox, and run