generic tools

[beroal]

I mean the programs described in “Programs to not confine”. As far as I understand, generic tools are the programs such that we need to give them different permissions depending on their parent process.

I'm not sure how to classify programs like basename, dirname, uname, sleep, date. They successfully work under the minimal profile. I can't imagine when they would need more permissions. Maybe, creating global profiles for these programs would not be a bad thing?

BTW, the libreoffice profile runs some of the programs above with ix. Surely they don't need all the permissions that LibreOffice has.

[roddhjav]

To sum up:

• basename, dirname, uname, sleep are used as internal tool when running a script. Similar to the standard library of a programming language. In the context of libreoffice, it may be possible to restrict them. However:
  • It might be useless as they are tool that are available anyway if you don't use bash.
  • Could lead to maintenance issues (file inherit, flags, logs files...). As example, see uname that Morfikov initially profiled.
• date can set the date. So it really depends of its context.