stilic

@shio relatable

@navi @june what do you think about the approach described in the last paragraph of this? https://madaidans-insecurities.github.io/guides/linux-hardening.html#systemd-service-sandboxing i don't necessarily think it's needed to reimplement that on your own but that's how i see things on my own so i dunno tbh

@june you could put bwrap in there or a similar tool as mentioned in https://madaidans-insecurities.github.io/guides/linux-hardening.html#systemd-service-sandboxing

I'm planning to switch my website to https://makko.starlightnet.work/ and eventually add a blog section :3

@lexi@lea.pet damn

@june@ublog.kimapr.net @navi@social.vlhl.dev Well this is coming from a security researcher who knows a lot about Linux security issues so I think they know what they're doing unless someone proves me wrong or smth Bubblewrap is pretty much able to do around 90% of the stuff systemd already does in terms of sandboxing without having to get its features reimplemented in the init system itself There are use cases for sandboxing a whole bootstrap process (https://github.com/fosslinux/live-bootstrap) or just building a few packages in an isolated environment (as done by a few package build systems), so I'm pretty sure that is sufficient on its own along with seccomp Bubblewrap has a large amount of CLI options if you have specific requirements in mind, it's very polyvalent Even ChromeOS has a tool for similar purposes (https://google.github.io/minijail/)