Installs and local privileges

Required

• Load libraries only from folders attackers cannot write

  DSK-27

  At start-up on Windows, limit the library search to the app's own folder and System32 with SetDefaultDllDirectories. Load every other library by its full path. Install machine-wide apps under Program Files, where only administrators can write.

• Check who is calling before a privileged helper acts

  DSK-28

  A helper or service that runs as root or SYSTEM accepts connections only from your own signed app, or from the signed-in users on Windows. It performs only actions from a fixed list, with checked arguments.

Recommended

• Start at login only after the user turns it on

  DSK-29

  Add the app to the login items or startup list only when the user turns on a switch in its settings. The switch starts off. Stop every background process when the user quits, unless they chose to keep one running.

• Ask for system permissions only when a feature needs them

  DSK-39

  Request each system permission, such as camera, microphone, screen recording, location or contacts, at the moment the user starts the feature that needs it. Give each one a purpose string that names the feature, and keep the app working when the user says no.

• Ask the Linux sandbox for the fewest permissions

  DSK-40

  Ship Flatpak and Snap packages with sandbox permissions limited to what the app uses. Use portals or interfaces for files and devices, and never grant the whole home folder, the whole file system or full session bus access.