Title. Just had this baseless yet possible idea on my head and I’d like to know how wrong it is? Since afaik, “nobody” has absolutely zero permissions… other than the ones given by the user. Pretty sure I’m missing something vital or important, but… I’m completely fine being called dumb every now and then.
Thanks in advance.
It’s a great idea, basically the goal of using docker or snaps. Linux containers attempt to strip processes of privilege except what they need to function. You can’t get away with giving zero permissions unless you want to give up saving files and using graphics hardware… Which is kind of necessary for a web browser.
Also selinux tries to do this with wacky rules and namespaces