On 14/11/2016 18:30, Tommaso Cucinotta wrote:
On 14/11/2016 14:59, Stephan Witt wrote:
Probably we need some more tweaking to make a really good sandbox
(e.g. limit network access too?).
AppArmor does that as well, otherwise you can still make damages only
reading (eg, read data from your home, pack it, send it / upload it
somewhere); AFAIU, sandbox-exec is similar on Mac, just need to
understand how to use those profiles, and/or whether it's worth
writing a new profile for LyX.
... and, in case there's any bug in the sandboxing, we'd have to live with that
till it's fixed in the OS :-)!
https://www.coresecurity.com/content/apple-osx-sandbox-bypass
T.
