WIP: Sandboxing APT (asg2023)
Chaos Computer Club - archive feed · Julian Andres Klode
September 13, 202321m 55s
Audio is streamed directly from the publisher (cdn.media.ccc.de) as published in their RSS feed. Play Podcasts does not host this file. Rights-holders can request removal through the copyright & takedown page.
Show Notes
A short case study on where we are with sandboxing APT; what gaps there are and what technologies we looked at.
Downloading packages, verifying packages, installing packages, protecting user data from snoopy or broken maintainer scripts. A package manager has a lot of places that can need some sort of sandboxing.
APT currently employs a minimal sandbox using a separate user for downloading, and optionally seccomp. This talk will explore that, the caveats and some more avenues like landlock, running apt in systemd isolation (useful for our apt-based .service units), file descriptor passing into sandbox.
about this event: https://cfp.all-systems-go.io/all-systems-go-2023/talk/8CGF9L/
Topics
asg20231982023