I’ve been thinking. Android implements app permissions on top of Linux, Flatpak does it too. But why is it it’s not part of the kernel?

Like all executable files would be sandboxed and would only be able to access syscalls and parts of the file system if they were allowed to. Making sandboxing the default instead of having to restrict programs.

I’m not a kernel developper so this question may be naive, but it bothers my mind. I guess part of it is because of historical reasons but are there any practical ones that make it not feasable?

EDIT : Thank you all for your answers, almost all of you were very nice and explained things clearly

    • e0qdk@reddthat.comEnglish
      19·
      3 days ago

      There’s also cgroups and Linux namespaces – probably most popularly interacted with via Docker currently.

      • Max-P@lemmy.max-p.meEnglish
        12·
        3 days ago

        That’s also effectively what Flatpak and Snap uses, and also Steam’s Runtime also uses containers.