crtxcr/looqs
1
0
Fork 0
Code Issues Pull Requests 1 Releases Wiki Activity

sandboxing: Disable mechanisms requiring namespaces

Browse Source 
Needs detection whether we have them available at some point, especially
since Ubuntu 24.04 blocks them with Apparmor. But for now, don't unshare
anything.

submodules: exile.h: Sync
This commit is contained in:
Albert S. 2024-07-21 15:39:29 +02:00
parent c74ef48b40
commit 2906b56cd6
3 changed files with 4 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
gui/main.cpp
View File

@ -25,11 +25,10 @@ void enableIpcSandbox()
qCritical() << "Failed to init policy for sandbox";
exit(EXIT_FAILURE);
}
policy->namespace_options = EXILE_UNSHARE_USER | EXILE_UNSHARE_MOUNT | EXILE_UNSHARE_NETWORK;
policy->namespace_options = 0;
policy->no_new_privs = 1;
policy->drop_caps = 1;
policy->drop_caps = 0;
policy->vow_promises = exile_vows_from_str("thread cpath rpath wpath unix stdio proc error");
policy->mount_path_policies_to_chroot = 1;
QString ipcSocketPath = Common::ipcSocketPath();
QFileInfo info{ipcSocketPath};

4
shared/sandboxedprocessor.cpp
View File

@ -38,13 +38,11 @@ void SandboxedProcessor::enableSandbox(QString readablePath)
qCritical() << "Could not init exile" << Qt::endl;
exit(PROCESSFAIL);
}
policy->namespace_options = EXILE_UNSHARE_NETWORK | EXILE_UNSHARE_USER;
policy->namespace_options = 0;
std::string readablePathLocation;
if(!readablePath.isEmpty())
{
policy->namespace_options |= EXILE_UNSHARE_MOUNT;
policy->mount_path_policies_to_chroot = 1;
readablePathLocation = readablePath.toStdString();
if(exile_append_path_policies(policy, EXILE_FS_ALLOW_ALL_READ, readablePathLocation.c_str()) != 0)
{

2
submodules/exile.h

@ -1 +1 @@
Subproject commit 44b9a17becf6882e1b3728cbf885ae9e5a6717af
Subproject commit 4cfdead5d0d2cb4ecee4e5e654e8e90dda683744