[bug#30256] [PATCH 3/3] scripts: environment: Add --no-cwd.

[Ludovic Courtès]

Hello,

Mike Gerwitz <address@hidden> skribis:

> On Sun, Mar 04, 2018 at 23:24:27 +0100, Ludovic Courtès wrote:

[...]

>> You still have to explicitly run ‘guix run icecat’, which isn’t great:
>> if you’re using GNOME Shell and clicking on the icon, you don’t get to
>> run it in a containerized environment.
>
> Well, I do everything from a shell, so that works for me personally. :)
> But yes, what you are describing is important.
>
> But, from a security perspective, I'd like for containerization to be
> _guaranteed_, otherwise a malicious script could just subvert it
> (e.g. open icecat with an argument to a malicious HTML file).  I used
> `guix environment` not only because of its container support, but
> because that ensured that icecat wasn't in my profile at all to be
> invoked by something else.

Good point.

> Currently, I'd have to write a package definition to add a wrapper; that
> wouldn't be done automatically for me.  But considering a functional
> package manager, it'd be an interesting problem to try to get around
> that.  And you don't want containerized versions of _every_
> package---that's some serious bloat.  Unless maybe they're packages that
> are generated from existing package definitions (in some
> yet-to-be-defined manner), and maybe those packages have a special
> containerized output (in addition to `out',
> e.g. `icecat:container').  (I suppose short-term, such outputs can be
> created manually for select packages.)

I was thinking ‘guix package’ could create those wrappers automatically
based on a number of criteria: a package property could request
containerization, command-line options could disable that, and so on.

> Just spewing thoughts.  I'm still not well-versed in Guix.  So maybe
> `guix run` is a good starting point and can be used by a wrapper in the
> future.  It also allows users to containerize something optionally---for
> example, maybe a user doesn't want to containerize their PDF reader, but
> if they are opening an untrusted PDF, they'll want to.  A GNOME context
> menu option to say "Open in isolated container" (sorta like Qubes)
> sounds attractive.

Yeah, though I very much think least authority would be a better default
than ambient authority.  :-)

Ludo’.