[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[bug#30256] [PATCH 3/3] scripts: environment: Add --no-cwd.
From: |
Ludovic Courtès |
Subject: |
[bug#30256] [PATCH 3/3] scripts: environment: Add --no-cwd. |
Date: |
Tue, 06 Mar 2018 11:20:23 +0100 |
User-agent: |
Gnus/5.13 (Gnus v5.13) Emacs/25.3 (gnu/linux) |
Hello,
Mike Gerwitz <address@hidden> skribis:
> On Sun, Mar 04, 2018 at 23:24:27 +0100, Ludovic Courtès wrote:
[...]
>> You still have to explicitly run ‘guix run icecat’, which isn’t great:
>> if you’re using GNOME Shell and clicking on the icon, you don’t get to
>> run it in a containerized environment.
>
> Well, I do everything from a shell, so that works for me personally. :)
> But yes, what you are describing is important.
>
> But, from a security perspective, I'd like for containerization to be
> _guaranteed_, otherwise a malicious script could just subvert it
> (e.g. open icecat with an argument to a malicious HTML file). I used
> `guix environment` not only because of its container support, but
> because that ensured that icecat wasn't in my profile at all to be
> invoked by something else.
Good point.
> Currently, I'd have to write a package definition to add a wrapper; that
> wouldn't be done automatically for me. But considering a functional
> package manager, it'd be an interesting problem to try to get around
> that. And you don't want containerized versions of _every_
> package---that's some serious bloat. Unless maybe they're packages that
> are generated from existing package definitions (in some
> yet-to-be-defined manner), and maybe those packages have a special
> containerized output (in addition to `out',
> e.g. `icecat:container'). (I suppose short-term, such outputs can be
> created manually for select packages.)
I was thinking ‘guix package’ could create those wrappers automatically
based on a number of criteria: a package property could request
containerization, command-line options could disable that, and so on.
> Just spewing thoughts. I'm still not well-versed in Guix. So maybe
> `guix run` is a good starting point and can be used by a wrapper in the
> future. It also allows users to containerize something optionally---for
> example, maybe a user doesn't want to containerize their PDF reader, but
> if they are opening an untrusted PDF, they'll want to. A GNOME context
> menu option to say "Open in isolated container" (sorta like Qubes)
> sounds attractive.
Yeah, though I very much think least authority would be a better default
than ambient authority. :-)
Ludo’.