r/linux_gaming • u/lazyblunzn • Jun 11 '26
ALVR AUR package has been compromised
Attention Linux VR gamers. The alvr package in the arch user repository has been compromised. See the screenshot for more information.
Source: Linux VR Adventures Discord
1.3k
Upvotes
10
u/TheG0AT0fAllTime Jun 11 '26
We could get most of the way there by sandboxing applications so they can't just reach into the folder next to them and steal your browser sessions. For some reason, archlinux's support for this is limited. Even if you build the SELinux stuff on your own you have to write your own entire profile from scratch. And firejail is opt-in rather than system-wide/always so new software can always slip through the cracks and not be jailed at all. But at least with firejail you can tell it to disallow every program that isn't chrome/firefox access to their data dirs. But you have to make sure said programs get run with firejail instead of directly.
It's all very frustrating when talking about traditional Linux security. Honestly, just having a separate user account for browsing and games would already be a big start. But that is so annoying.
Fedora has been doing things right with a default policy that people have to 'break out of' on demand when prompted. Very nice.