71–80 of 277 posts
> Is there any way to prevent it? Put it into it's own namespace, and only allow it to connect to your X11 session over TCP.
If you want to prevent programs from accessing other windows, then (in addition to using its own namespace and file access) you would also need to proxy the X server, or run it in a nested X server (which does not have access to the one outside).
Firejail[0] allows cobbling together various linux sandboxing features, including namespaces which should result in an isolated proc filesystem which doesn't see the other processes. But I don't know if the default profile for zoom does that, you have to test it or write your own.
And for people giving ways to prevent it, can you please provide some context for those of us who aren't OS experts?
"Zoom does not work on my computer*, can we try X instead?" With X = something the other end does not need to install, like Jitsi Meet for instance *no need to explain that's because you uninstalled it and blocked its domain on your computer.
Zoom is very invasive / flexible - so it's actually somewhat hard to have it NOT work. People will suggest you try connecting on your phone or dialing in if you really can't figure it out (note that it has a fallback to browser option if you get stuck trying to start meeting as well).
I know of at least one job interview where they claimed they couldn't get zoom to run / couldn't connect - and that was basically decisive.
Earlier quoted context omitted.
Unless I'm missing something.. all of the required information is available through the X11 protocol. Reading the command lines of the processes is unnecessary and provides data that isn't useful in the window sharing context.
This would not work on Wayland, though.
With X11 if the window manager doesn't have the relevant support you can always ask the server.
> Is there any way to prevent it? Mounting /proc with " hidepid=2 " should prevent it from seeing processes owned by other users, although it would still be able to see your processes. Alternatively, it shouldn't be too hard to create an AppArmor profile that blocks access to /proc. Other options might include things like SELinux, seccomp-bpf, namespaces, cgroups, etc., depending on what's available on your host. Or…
I don't understand why anyone who is forced to use it doesn't use it in a browser (I have a separate Firefox container for that, same for Teams).
It's not like BlueJeans which has a web version pretty much aligned with the desktop client.
But if you really must, use the web version only.
If you can avoid it, jitsi is a great alternative. Much smoother video than teams and much lighter
> Is there any way to prevent it? Mounting /proc with " hidepid=2 " should prevent it from seeing processes owned by other users, although it would still be able to see your processes. Alternatively, it shouldn't be too hard to create an AppArmor profile that blocks access to /proc. Other options might include things like SELinux, seccomp-bpf, namespaces, cgroups, etc., depending on what's available on your host. Or…
I don't understand why anyone who is forced to use it doesn't use it in a browser (I have a separate Firefox container for that, same for Teams).
> Is there any way to prevent it? I prevent it by running Zoom in a VM on Qubes OS.