diff --git a/gui/main.cpp b/gui/main.cpp index 57d4f24..7abb6c2 100644 --- a/gui/main.cpp +++ b/gui/main.cpp @@ -25,11 +25,10 @@ void enableIpcSandbox() qCritical() << "Failed to init policy for sandbox"; exit(EXIT_FAILURE); } - policy->namespace_options = EXILE_UNSHARE_USER | EXILE_UNSHARE_MOUNT | EXILE_UNSHARE_NETWORK; + policy->namespace_options = 0; policy->no_new_privs = 1; - policy->drop_caps = 1; + policy->drop_caps = 0; policy->vow_promises = exile_vows_from_str("thread cpath rpath wpath unix stdio proc error"); - policy->mount_path_policies_to_chroot = 1; QString ipcSocketPath = Common::ipcSocketPath(); QFileInfo info{ipcSocketPath}; diff --git a/shared/sandboxedprocessor.cpp b/shared/sandboxedprocessor.cpp index 2213c2d..04b4fef 100644 --- a/shared/sandboxedprocessor.cpp +++ b/shared/sandboxedprocessor.cpp @@ -38,13 +38,11 @@ void SandboxedProcessor::enableSandbox(QString readablePath) qCritical() << "Could not init exile" << Qt::endl; exit(PROCESSFAIL); } - policy->namespace_options = EXILE_UNSHARE_NETWORK | EXILE_UNSHARE_USER; + policy->namespace_options = 0; std::string readablePathLocation; if(!readablePath.isEmpty()) { - policy->namespace_options |= EXILE_UNSHARE_MOUNT; - policy->mount_path_policies_to_chroot = 1; readablePathLocation = readablePath.toStdString(); if(exile_append_path_policies(policy, EXILE_FS_ALLOW_ALL_READ, readablePathLocation.c_str()) != 0) { diff --git a/submodules/exile.h b/submodules/exile.h index 44b9a17..4cfdead 160000 --- a/submodules/exile.h +++ b/submodules/exile.h @@ -1 +1 @@ -Subproject commit 44b9a17becf6882e1b3728cbf885ae9e5a6717af +Subproject commit 4cfdead5d0d2cb4ecee4e5e654e8e90dda683744