12 ms·
You will want at least a separate session for the `restricteduser`: E.g. with X11, a process in the same session can do almost anything with your input/output.
by Dacit 2mo ago
You will want at least a separate session for the `restricteduser`: E.g. with X11, a process in the same session can do almost anything with your input/output. And most Linux distributions make it really hard to disable external device access for individual users...
- bombcar 2mo agoQubes OS - AI Agent edition would actually be a great idea.
- WhyNotHugo 2mo ago> And most Linux distributions make it really hard to disable external device access for individual users... For any distro that relies on the traditional plugdev group, just don't add those users to the plugdev group. Which would be the default when creating a user anyway.
- __MatrixMan__ 2mo agoYeah, it's sensible to go further in many cases. I guess I'm saying: let's go at least this far.