What Use Is a Confined User Shell?
summary
Shows how snap confinement (AppArmor-based) limits system calls and file access, using Mir and snapd to run confined graphical shells; demonstrates a full-screen mere kiosk (wpwebkit kiosk) and a multiapp egmde confined desktop on Ubuntu Core and Raspberry Pi. Notes ~10,000 lines of AppArmor rules collapsed into snap interfaces, manual interface connections during demos, small syscall overhead, inability for confined snaps to invoke other snaps (patch to snapd under review), and mostly working proofs of concept.
AI-written summary · about
chapters (6)
- 0:00Start
- 1:16Confinement Model
- 3:33Snap Confinement
- 38:44Summary
- 41:05What Is the Performance Impact of Snap Confinement
- 42:07What's Involved in Making a Snap System
related talks
50mImproving Unmodified Classic Application Confinement
25mkeynote – Jane Silber
01h 25mSandboxing a Linux Application
26mMy Journey from early Linux through Snap packaging to WSL
42mSandboxing a Linux application
38mSandboxing in Linux with zero lines of code
38mOn the Way to Safe Containers
27mAn Ubuntu for a 10 ton steel press and your window shades