Conversation

Notices

1. Embed this notice
   Erin 💽✨ (erincandescent@akko.erincandescent.net)'s status on Friday, 29-Mar-2024 00:51:49 JST Erin 💽✨

   @chjara pledge is very hard to use when your entire app+dependencies codebase (incl. libc) isn’t in one repository

   do you know which glibc functions open random magic files in /proc? I sure don’t

   • Haelwenn /элвэн/ :triskell: likes this.
   • Embed this notice
     Haelwenn /элвэн/ :triskell: (lanodan@queer.hacktivis.me)'s status on Friday, 29-Mar-2024 00:57:31 JST Haelwenn /элвэн/ :triskell:

     in reply to
     @erincandescent @chjara Yeah, pretty glad some of that stuff made it to OpenRC.
     
     And I'd guess AppArmor/SELinux makes more sense for Linux but it doesn't plays well with unshare/bwrap so you can't use it everywhere.
   • Embed this notice
     Erin 💽✨ (erincandescent@akko.erincandescent.net)'s status on Friday, 29-Mar-2024 00:57:33 JST Erin 💽✨

     in reply to

     @chjara The systemd ProtectXXX= declarations are much more pragmatic IMO, its easy to say “this app doesn’t need /home” and similar