6 ms·
It is, but nothing can be done about it. That's how Linux permissions work. Any app running as me can execute any other app I have permissions to run. It can pi
by M95D 27d ago
It is, but nothing can be done about it. That's how Linux permissions work. Any app running as me can execute any other app I have permissions to run. It can pipe stdin/out/err, trace it, etc. Why should the desktop apps be different?
See my other comment too.
- zbentley 26d agoMy desktop apps can’t trace other apps because they don’t have my sudo password. Some of my desktop apps run in containers/snaps or whatnot and other user processes can’t get to their internals without pivoting to root. Apps can’t read each other’s memory because of segmentation. There is a lot more to desktop inter-app security than “if an app had a root shell then it could compromise things”. A great many attack vectors that we see constantly have a much narrower ingress than that.
- M95D 26d agoYou don't need sudo for trace under the same account. You can even attach a debugger and read all app's memory. Virtualization is another thing entirely. But if you want it that way, then why not simply start a second X for the untrusted app?