Hacker News Reader

JFYI, firejail can do all of that. It can start each application in a separate xserver (giving you a choice from several implementations), deny access to everything with whitelisting (or do the reverse — your choice). The profiles are really easy to read and write, and it already covers a lot of popular stuff.

View on HN

Still hoping for something other than Firejail to come along: The way profiles are designed is brittle and an order-dependent override hell, and it's common to use denylists vs. allowlists.

Firejail is a setuid binary with tons of attack surface and has had a number of privescs itself[1], unlike something like the lower-level Bubblewrap tool.

I'm glad it exists, though - it's the only mature solution other than Flatpak that has proper dbus filtering, among other things.

[1]: https://www.cvedetails.com/vulnerability-list/vendor_id-1619...

Reply on news.ycombinator.com