Comment by jitl
stuff that talks to "the internet" and runs as "root" seems like a good thing to build with filc.
stuff that talks to "the internet" and runs as "root" seems like a good thing to build with filc.
No, that doesn't follow. That only means the networking and parsing functions can't be sandboxed in the same process that drops new root-owned files. C and C++ services have been using subprocesses for sandboxing risky functionality for a long time now. It appears Apt has some version of this:
https://salsa.debian.org/apt-team/apt/-/blob/main/apt-pkg/co...
That's true; you can't usefully sandbox apt as a whole, but, because it verifies the signatures of the packages it downloads, you could usefully sandbox the downloading process, and you could avoid doing any parsing on the package file until you've validated its signature. It's a pleasant surprise to hear that it already does something like this!
It probably uses OS sandboxing primitives already.