Also, operating systems should let us set filesystem permissions per app/process/executable instead of just user accounts.
Similar to how macOS/iOS Sandboxing works but at a more lower and granular level
Also, operating systems should let us set filesystem permissions per app/process/executable instead of just user accounts.
Similar to how macOS/iOS Sandboxing works but at a more lower and granular level
SELinux is basically this.
Is that the service that everyone turns off as the first step of setting up their new Linux box?
It's the LSM that billions of Android users use every day.
https://www.canyonroad.ai/ does some of this in a way tailored to agents.
personally I wish the OS would allow syscall filtering per user
[dead]