BROADCASTS.com

b'A short case study on where we are with sandboxing APT; what gaps there are and what technologies we looked at.\\n\\nDownloading packages, verifying packages, installing packages, protecting user data from snoopy or broken maintainer scripts. A package manager has a lot of places that can need some sort of sandboxing.\\n\\nAPT currently employs a minimal sandbox using a separate user for downloading, and optionally seccomp. This talk will explore that, the caveats and some more avenues like landlock, running apt in systemd isolation (useful for our apt-based .service units), file descriptor passing into sandbox.\\nabout this event: https://cfp.all-systems-go.io/all-systems-go-2023/talk/8CGF9L/'