1
00:00:00,000 --> 00:00:02,160
In this lesson we're going to be discussing

2
00:00:02,160 --> 00:00:03,960
application sandboxing,

3
00:00:03,960 --> 00:00:06,780
also known as application containerization.

4
00:00:06,780 --> 00:00:09,120
This approach to software development and management

5
00:00:09,120 --> 00:00:10,320
creates a safe environment

6
00:00:10,320 --> 00:00:12,330
for running and testing computer code

7
00:00:12,330 --> 00:00:15,180
that keeps users and production environment safe.

8
00:00:15,180 --> 00:00:17,040
Now the term sandbox usually comes from

9
00:00:17,040 --> 00:00:19,080
the idea of a child's sandbox,

10
00:00:19,080 --> 00:00:20,550
in which the sand and the toys

11
00:00:20,550 --> 00:00:23,430
are kept inside a small container or walled area

12
00:00:23,430 --> 00:00:26,170
so the children can play safely without making a huge mess.

13
00:00:26,170 --> 00:00:28,470
Now, with the sandboxing approach,

14
00:00:28,470 --> 00:00:32,159
every software application is given its own unique sandbox

15
00:00:32,159 --> 00:00:34,410
which is a controlled, restricted environment

16
00:00:34,410 --> 00:00:36,720
for them to run and execute their code.

17
00:00:36,720 --> 00:00:39,030
This environment helps developers isolate

18
00:00:39,030 --> 00:00:41,310
and protect system resources from malware

19
00:00:41,310 --> 00:00:43,890
and other kinds of cybersecurity threats.

20
00:00:43,890 --> 00:00:46,260
Using this method, it's easier to identify

21
00:00:46,260 --> 00:00:48,960
how a software behaves and spot any malware

22
00:00:48,960 --> 00:00:50,790
or other undesirable program elements

23
00:00:50,790 --> 00:00:52,320
that may be running.

24
00:00:52,320 --> 00:00:55,680
Application sandboxing is there to help improve security

25
00:00:55,680 --> 00:00:58,140
by isolating and shielding the application

26
00:00:58,140 --> 00:01:01,020
from outside intruders and malware as well.

27
00:01:01,020 --> 00:01:04,019
This kind of separation helps create a secure environment

28
00:01:04,019 --> 00:01:05,489
so the app can run without the risk

29
00:01:05,489 --> 00:01:07,650
of damaging the overall system.

30
00:01:07,650 --> 00:01:09,420
This approach is especially useful

31
00:01:09,420 --> 00:01:11,460
when you're running or testing applications

32
00:01:11,460 --> 00:01:14,430
from untrustworthy sources or websites.

33
00:01:14,430 --> 00:01:17,730
Now sandboxing also increases application integrity

34
00:01:17,730 --> 00:01:18,930
because it lets the developers

35
00:01:18,930 --> 00:01:21,360
wrap the application in security policies

36
00:01:21,360 --> 00:01:23,370
and isolate and protect the application

37
00:01:23,370 --> 00:01:26,010
within its own virtualized environment.

38
00:01:26,010 --> 00:01:28,290
Now to provide sandboxing of your applications

39
00:01:28,290 --> 00:01:30,240
on analytics system you're going to use

40
00:01:30,240 --> 00:01:33,870
either snapd, Flatpak or app control.

41
00:01:33,870 --> 00:01:35,850
Let's take a look at each of these.

42
00:01:35,850 --> 00:01:38,640
The first one we're going to look at is known as snapd,

43
00:01:38,640 --> 00:01:39,960
which is part of snaps,

44
00:01:39,960 --> 00:01:42,630
which is a form of application sandboxing.

45
00:01:42,630 --> 00:01:45,630
Now a snap is really a bundle that contains an application

46
00:01:45,630 --> 00:01:48,390
and its dependencies that work without modification

47
00:01:48,390 --> 00:01:50,790
across all Linux distributions.

48
00:01:50,790 --> 00:01:53,880
By using snaps, you're going to receive an easy to install

49
00:01:53,880 --> 00:01:57,600
secure cross platform and dependency free application

50
00:01:57,600 --> 00:01:59,520
that you can then run on your system.

51
00:01:59,520 --> 00:02:02,520
Now to manage and maintain your snaps or applications,

52
00:02:02,520 --> 00:02:05,250
you need to run the snapd or snap daemon

53
00:02:05,250 --> 00:02:06,990
on your Linux system.

54
00:02:06,990 --> 00:02:09,300
Now, once the snap framework is installed,

55
00:02:09,300 --> 00:02:12,030
you're going to have the snap command and the snapd command

56
00:02:12,030 --> 00:02:13,620
available for use.

57
00:02:13,620 --> 00:02:15,960
The snap command can be used to find a snap

58
00:02:15,960 --> 00:02:18,090
or application that you want to install,

59
00:02:18,090 --> 00:02:20,940
similar to other package managers you may have used.

60
00:02:20,940 --> 00:02:22,920
Now, for example, let's say you enter

61
00:02:22,920 --> 00:02:25,650
snap find "media player."

62
00:02:25,650 --> 00:02:26,700
You're going to get back a list

63
00:02:26,700 --> 00:02:28,170
of all the different media players

64
00:02:28,170 --> 00:02:31,050
that are available to download as a snap bundle.

65
00:02:31,050 --> 00:02:34,230
Now, if you want to install a media player like VLC,

66
00:02:34,230 --> 00:02:38,730
you can do that by entering sudo snap install VLC

67
00:02:38,730 --> 00:02:39,870
and pressing enter.

68
00:02:39,870 --> 00:02:42,630
And then it's going to download and install VLC

69
00:02:42,630 --> 00:02:45,960
onto your system as a sandboxed application.

70
00:02:45,960 --> 00:02:48,600
Now, by default, the applications are going to be installed

71
00:02:48,600 --> 00:02:51,570
under the /snap/ bin directory.

72
00:02:51,570 --> 00:02:54,630
So in the case of VLC, if you want to run it

73
00:02:54,630 --> 00:02:57,780
you're going to need to add the /snap/bid directory

74
00:02:57,780 --> 00:02:59,910
to your Systems environmental path variable,

75
00:02:59,910 --> 00:03:01,723
or you're going to have to switch that directory

76
00:03:01,723 --> 00:03:03,720
and run it from there.

77
00:03:03,720 --> 00:03:06,150
Now, when it comes time to update an application,

78
00:03:06,150 --> 00:03:11,150
you can easily do that by entering sudo snap refresh VLC,

79
00:03:11,220 --> 00:03:12,270
as an example.

80
00:03:12,270 --> 00:03:14,250
And that way the VLC application

81
00:03:14,250 --> 00:03:16,770
will be replaced with the latest version.

82
00:03:16,770 --> 00:03:19,920
Snapd as I said is really the backend daemon

83
00:03:19,920 --> 00:03:22,620
that runs the snaps for you on your system.

84
00:03:22,620 --> 00:03:24,390
Now, unfortunately by default,

85
00:03:24,390 --> 00:03:27,360
snap doesn't come pre-installed on set OS,

86
00:03:27,360 --> 00:03:30,480
but you can install it using the yum package manager

87
00:03:30,480 --> 00:03:34,770
and entering the command sudo yum install snapd.

88
00:03:34,770 --> 00:03:36,630
Now once you've installed snapd,

89
00:03:36,630 --> 00:03:38,910
you're also going to need to enable network communication

90
00:03:38,910 --> 00:03:41,220
for the snapd utility by entering

91
00:03:41,220 --> 00:03:46,220
sudo systemctl enable -- now snapd.socket.

92
00:03:48,210 --> 00:03:51,330
The second command we need to cover is known as Flatpak.

93
00:03:51,330 --> 00:03:53,370
Now Flatpak, just like snaps,

94
00:03:53,370 --> 00:03:55,470
is a universal packaging system

95
00:03:55,470 --> 00:03:58,470
that lets you distribute, install and manage software

96
00:03:58,470 --> 00:04:01,140
without need to worry about the dependencies, runtime

97
00:04:01,140 --> 00:04:04,170
or specific Linux distribution that's being used.

98
00:04:04,170 --> 00:04:07,320
For this to work Flatpak runs in an isolated environment

99
00:04:07,320 --> 00:04:09,960
known as the sandbox that contains everything needed

100
00:04:09,960 --> 00:04:11,700
for that program to operate.

101
00:04:11,700 --> 00:04:14,310
Again because these apps are sandbox,

102
00:04:14,310 --> 00:04:17,279
they cannot affect your underlying Linux operating system.

103
00:04:17,279 --> 00:04:18,959
And this provides you with better security

104
00:04:18,959 --> 00:04:21,480
than directly installing these apps using yum

105
00:04:21,480 --> 00:04:22,740
or other package managers

106
00:04:22,740 --> 00:04:25,080
that don't sandbox the applications.

107
00:04:25,080 --> 00:04:27,300
To run Flatpak, you're simply going to enter

108
00:04:27,300 --> 00:04:30,240
Flatpak [options] and the command.

109
00:04:30,240 --> 00:04:33,300
The third command we need to cover is known as App Image.

110
00:04:33,300 --> 00:04:36,390
Now App Image is another application containerization

111
00:04:36,390 --> 00:04:37,980
or sandboxing tool.

112
00:04:37,980 --> 00:04:40,650
This is yet another universal package manager

113
00:04:40,650 --> 00:04:41,970
where the apps are going to be installed

114
00:04:41,970 --> 00:04:43,980
without modifying your system libraries

115
00:04:43,980 --> 00:04:45,690
or system preferences.

116
00:04:45,690 --> 00:04:46,860
With App Image,

117
00:04:46,860 --> 00:04:49,320
you simply download the packages that you want to run

118
00:04:49,320 --> 00:04:51,690
and then you run them without installing them.

119
00:04:51,690 --> 00:04:54,510
Because of this, these are called portable apps.

120
00:04:54,510 --> 00:04:55,590
And because they're portable,

121
00:04:55,590 --> 00:04:56,910
you can really run them from anywhere

122
00:04:56,910 --> 00:04:58,290
on your operating system.

123
00:04:58,290 --> 00:04:59,250
And because of that,

124
00:04:59,250 --> 00:05:01,230
you'll often end up with App Image files

125
00:05:01,230 --> 00:05:03,750
all over your hard disc if you're not careful,

126
00:05:03,750 --> 00:05:06,570
because they can really run from literally anywhere.

127
00:05:06,570 --> 00:05:08,970
Personally, I recommend that you create a directory

128
00:05:08,970 --> 00:05:11,520
under your home directory called applications

129
00:05:11,520 --> 00:05:13,890
and put all your App Image applications in there

130
00:05:13,890 --> 00:05:15,870
so they're all in one place.

131
00:05:15,870 --> 00:05:18,000
App Image packages are usually going to be run

132
00:05:18,000 --> 00:05:20,430
from within your graphical user interface too.

133
00:05:20,430 --> 00:05:22,890
So as long as that file is set to executable,

134
00:05:22,890 --> 00:05:25,470
you can simply double click on the App Image package

135
00:05:25,470 --> 00:05:27,780
and load it up and run that program.

136
00:05:27,780 --> 00:05:29,430
Now, if you want to be fully integrated

137
00:05:29,430 --> 00:05:31,380
into your graphical user interface

138
00:05:31,380 --> 00:05:34,980
you should install the App Image daemon or App Image D

139
00:05:34,980 --> 00:05:37,050
which will allow it to go into the context menus

140
00:05:37,050 --> 00:05:40,110
and other places just like any other program.

141
00:05:40,110 --> 00:05:42,240
Now, as you can see, there are lots of different ways

142
00:05:42,240 --> 00:05:44,250
to accomplish the same thing in Linux.

143
00:05:44,250 --> 00:05:46,530
And when we talk about application sandboxing,

144
00:05:46,530 --> 00:05:50,430
we really do this using either snaps, Flatpak or App Image

145
00:05:50,430 --> 00:05:52,080
as the common ways to conduct this

146
00:05:52,080 --> 00:05:54,120
on your Linux servers and workstations

147
00:05:54,120 --> 00:05:56,570
to increase the overall security of your devices.