Bubblewrap: Unprivileged sandboxing tool for Linux
Still requires SUID. It makes no sense to have to increase privileges in order to be able to decrease privileges. Any process should be able to spawn a child process with strictly lesser privileges, including granular cpu, memory, network, and filesystem (including path and size restrictions) access. It's sad there isn't a simple, standard cross-platform API for doing this.I would be fine having to rewrite my apps to take advantage of some fancy capabilities-based security paradigm, but give me realistic APIs to do so.I'm currently experimenting with shipping apps as QEMU VMs, packaging QEMU and a minimal kernel with the app. It works surprisingly well, even on Windows with full x86 emulation. And with their newish WHPX API (basically kvm for Windows) the future might be really exciting.EDIT: Someone on the Firejail thread says bubblewrap can be compiled non-SUID and that's the common usage these days. I need to look into this more.