On Sun, Mar 04, 2018 at 23:24:27 +0100, Ludovic Courtès wrote:
> Right.  The ‘guix run’ script I sent doesn’t try to build things; it
> just takes whatever is in $PATH (which has to be in the store,
> ultimately) and runs it.

Oh, great!

>> Obviously the desirable behavior is to just containerize whatever is in
>> your profile, if possible.  Maybe the script you sent me does just
>> that.  I'm excited to play around with it, I just can't atm. :(
>
> You still have to explicitly run ‘guix run icecat’, which isn’t great:
> if you’re using GNOME Shell and clicking on the icon, you don’t get to
> run it in a containerized environment.

Well, I do everything from a shell, so that works for me personally. :)
But yes, what you are describing is important.

But, from a security perspective, I'd like for containerization to be
_guaranteed_, otherwise a malicious script could just subvert it
(e.g. open icecat with an argument to a malicious HTML file).  I used
`guix environment` not only because of its container support, but
because that ensured that icecat wasn't in my profile at all to be
invoked by something else.

Currently, I'd have to write a package definition to add a wrapper; that
wouldn't be done automatically for me.  But considering a functional
package manager, it'd be an interesting problem to try to get around
that.  And you don't want containerized versions of _every_
package---that's some serious bloat.  Unless maybe they're packages that
are generated from existing package definitions (in some
yet-to-be-defined manner), and maybe those packages have a special
containerized output (in addition to `out',
e.g. `icecat:container').  (I suppose short-term, such outputs can be
created manually for select packages.)

Just spewing thoughts.  I'm still not well-versed in Guix.  So maybe
`guix run` is a good starting point and can be used by a wrapper in the
future.  It also allows users to containerize something optionally---for
example, maybe a user doesn't want to containerize their PDF reader, but
if they are opening an untrusted PDF, they'll want to.  A GNOME context
menu option to say "Open in isolated container" (sorta like Qubes)
sounds attractive.

-- 
Mike Gerwitz
Free Software Hacker+Activist | GNU Maintainer & Volunteer
GPG: D6E9 B930 028A 6C38 F43B  2388 FEF6 3574 5E6F 6D05
https://mikegerwitz.com