How mono-sgen is suppose to work?

[nobody43]

It seems that C# programs are executed in the same context as the main profile ($ mono-sgen some.exe). Is there a way around it?
If that's by design, we have number of problems:

• As C# programs are generally third-party and untrusted, line /{usr/,}bin/* rPUx, poses a significant threat to the system. Surely we won't have profile for everything such as killall and shred?
• /usr/share/.mono/{,**} rw, Aren't /usr immutable for everything besides package manager? Moreover, this path is a place for a trust chain.

PS: maybe open up the Discussion section?

[roddhjav]

We do have a problem. It is actually bigger than this. Most of the interpreter will have the same issues. For instance, for Javascript in gnome: gjs-console raise the same concern.

The ideal way would probably be to have something similar to python: an abstraction that is used for all JS/C# resource by individual profile. However, as most of the time mono-sgen/gjs-console is called directly it is not possible to direct the process to the good profile. This is also why these profiles have /{usr/,}bin/* rPUx, as they can run deps different program depending of the program.

Aren't /usr immutable for everything besides package manager?

In a perfect world, yes. In practice no.

PS: Discussion should be open now.

[nobody43]

Damn. So we are waiting for the new AA version.

Could you explain the problem in profile file, so it won't be raised again?

[roddhjav]

Damn. So we are waiting for the new AA version.

Yes, future version of AA could help us on this.

Could you explain the problem in profile file, so it won't be raised again?

Not sure I understand your question here.

[nobody43]

Not sure I understand your question here.

Explaining not just here, but also inside mono-sgen file.