Comment by ranger_danger
3 hours ago
Yes I think privacy and security on the desktop has fallen way behind mobile and we need much stronger protection these days.
3 hours ago
Yes I think privacy and security on the desktop has fallen way behind mobile and we need much stronger protection these days.
Mobile's came at the cost of composability between programs and the imposition of policy, which are against the Unix Philosophy. I wouldn't make that trade. Mobile's a sad state of affairs, inferior to desktop in many ways.
You can most likely get better security than mobile's, you just need to e.g. learn to write your own SELinux policies, etc. Facilities are there; they just have a learning curve.
How do you write SELinux policies to allow reading only certain files in /proc, where process IDs are not known ahead? I ended up writing my own FUSE-based /proc emulation. The facilities are there, but it feels like writing your own OS.
What kind of use-case do you have for that? I suppose whatever it is, you could also e.g. write a privileged service that checks those files with whatever security policy you need. Your client wouldn't have direct access to /proc.
Another option may be to set up a container or PID namespace and give your tool direct access to that /proc.
Regarding SELinux, looking at https://unix.stackexchange.com/questions/767564/selinux-deni...
> the entries under /proc/<pidnr>/ are running under the respective pid's domain
It also seems doable, since you can differentiate which PID directory belongs to what by the domain.
Mobile has no privacy, devs slap in any old SDK that promises them money. Way worse than desktop. Spyware is the basis for mobile apps.