Replies: 1 comment
-
(For future reference) Related discussion: #4600. See also the following review thread specifically: |
Beta Was this translation helpful? Give feedback.
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
-
uaccess grants users ACL access to devices while they are logged in.
This can be beneficial for multi-seat public computers. But, I haven't heard of anyone using firejail in public computers.
Any public computer admin who breaks things with firejail may get fired. Owners of public facilities don't have the patience of a home user. Most facility owners don't know much about computers. Firejail targets home users. Each home user has at least one dedicated machine.
I am also almost always logged in while my computer is turned on.
For personal computers, this doesn't make much difference from group-based access to devices, but it adds more moving parts which can go wrong.
While
noroot
andnogroups
can improve security, I don't see them improving security much because most of security benefits come from whitelist and blacklist. Hackers can't do much with supplementary groups. Doesnoroot
make difference? I think firejail blocks root access and SUID binaries anyway with or withoutnoroot
.If a malware gains user rights, neither uaccess or group-based access control is going to stop the malware. Supplementary groups and root access aren't the prize. User rights are.
For single-user systems which account for the vast majority of personal computers, I don't see uaccess making much difference, but uaccess can make things convenient by granting access automatically. Without uaccess, users have to add themselves manually to groups. Thus, I view uaccess as a convenience feature rather than a security feature. If you are always logged in anyway, uaccess doesn't seem to make much difference.
Beta Was this translation helpful? Give feedback.
All reactions