[–] em3rgent0rdr 4y ago ↗ Isn't restricting chromium to only ~/Downloads already possible in a regular Linux OS by running chromium inside a chroot? [–] tyingq 4y ago ↗ Perhaps, though with a fair amount of hassle giving it access to device files, shared libraries, dynamically loaded plugins, and so on. [–] tata71 4y ago ↗ You'd use a portable build. [–] yjftsjthsd-h 4y ago ↗ The easy option is firejail, which ships with premade profiles to give things exactly what they need to run, ex. https://github.com/netblue30/firejail/blob/master/etc/profil... [–] tyingq 4y ago ↗ Sort of. For example:https://github.com/netblue30/firejail/issues/1950There are other, similar issues. It's a fair amount of work sussing it all out. [–] DarylZero 4y ago ↗ Not really, since ~/Downloads isn't inside a chroot. You accomplish it most easily with AppArmor.Anyway, OP is telling you how to do it with OpenBSD, which is also a "regular" OS. [–] [deleted] 4y ago ↗ (comment deleted)
[–] tyingq 4y ago ↗ Perhaps, though with a fair amount of hassle giving it access to device files, shared libraries, dynamically loaded plugins, and so on. [–] tata71 4y ago ↗ You'd use a portable build. [–] yjftsjthsd-h 4y ago ↗ The easy option is firejail, which ships with premade profiles to give things exactly what they need to run, ex. https://github.com/netblue30/firejail/blob/master/etc/profil... [–] tyingq 4y ago ↗ Sort of. For example:https://github.com/netblue30/firejail/issues/1950There are other, similar issues. It's a fair amount of work sussing it all out.
[–] yjftsjthsd-h 4y ago ↗ The easy option is firejail, which ships with premade profiles to give things exactly what they need to run, ex. https://github.com/netblue30/firejail/blob/master/etc/profil... [–] tyingq 4y ago ↗ Sort of. For example:https://github.com/netblue30/firejail/issues/1950There are other, similar issues. It's a fair amount of work sussing it all out.
[–] tyingq 4y ago ↗ Sort of. For example:https://github.com/netblue30/firejail/issues/1950There are other, similar issues. It's a fair amount of work sussing it all out.
[–] DarylZero 4y ago ↗ Not really, since ~/Downloads isn't inside a chroot. You accomplish it most easily with AppArmor.Anyway, OP is telling you how to do it with OpenBSD, which is also a "regular" OS. [–] [deleted] 4y ago ↗ (comment deleted)
[–] xupybd 4y ago ↗ Could I do this with Docker on Windows? [–] shipmaker 4y ago ↗ I use Sandboxie plus on Windows, easy to set-up, found no faults yet
10 comments
[ 4.0 ms ] story [ 22.8 ms ] threadhttps://github.com/netblue30/firejail/issues/1950
There are other, similar issues. It's a fair amount of work sussing it all out.
Anyway, OP is telling you how to do it with OpenBSD, which is also a "regular" OS.