| 1 Jul 2021 |
 Synthetica | Or luck I guess | 11:29:48 |
 balsoft | So, to paraphrase, kunrooted if you're worried about these sorts of things you should first worry about all the ez root vulneratilibies in Linux itself | 11:30:11 |
| balsoft | And maybe not give untrusted users access to your computer | 11:30:27 |
| balsoft | Or at least put them in separate containers | 11:30:34 |
| Synthetica | Is it possible to deny "regular" users the -x flag on /nix/store so you can't do that? | 11:31:08 |
 kunrooted | Can we consider NixOS containers security concern? | 11:31:23 |
| kunrooted | In reply to @balsoft:balsoft.ru
So, to paraphrase, kunrooted if you're worried about these sorts of things you should first worry about all the ez root vulneratilibies in Linux itself okie, thanks | 11:31:35 |
| Synthetica | As in QEMU containers? | 11:31:37 |
 Linux Hackerman | yeah I wouldn't rely on strong isolation in nixos containers. | 11:31:39 |
| balsoft | In reply to @kunrooted:matrix.org
Can we consider NixOS containers security concern? Yes, they are explicitly not for security | 11:31:47 |
| kunrooted | afaik they're not isolated at all | 11:31:57 |
| kunrooted | root in container = root on the host | 11:32:10 |
| kunrooted | Or had they changed that? | 11:32:14 |
| balsoft | No | 11:32:19 |
| balsoft | It's still there | 11:32:23 |
| kunrooted | lmfao | 11:32:44 |
 das_j | In reply to @synthetica:matrix.org
Is it possible to deny "regular" users the -x flag on /nix/store so you can't do that? AppArmor works pretty well for this | 11:32:58 |
| kunrooted | anything else which comes to your mind guys? | 11:33:06 |
| balsoft | In reply to @synthetica:matrix.org
Is it possible to deny "regular" users the -x flag on /nix/store so you can't do that? How would the system work? | 11:33:17 |
| balsoft | Oh, you mean non-recursively | 11:33:30 |
| balsoft | Well | 11:33:56 |
| balsoft | Let me try :P | 11:33:58 |
| balsoft | Oh no | 11:34:25 |
| balsoft | Bad idea | 11:34:26 |
| Synthetica | What happens? :D | 11:34:38 |
| balsoft | well fuck | 11:34:46 |
| das_j | Pretty sure you can't access subdirectories | 11:34:57 |
| Synthetica | oh, I thought you could only not list them | 11:35:11 |
| das_j | that's r iirc | 11:35:19 |
| balsoft | Uhhh | 11:35:33 |
