crtxcr/looqs
1
0
Fork 0
Code Issues Pull Requests 1 Releases Wiki Activity

sandboxing: Disable mechanisms requiring namespaces

Browse Source 
Needs detection whether we have them available at some point, especially
since Ubuntu 24.04 blocks them with Apparmor. But for now, don't unshare
anything.

submodules: exile.h: Sync
This commit is contained in:
Albert S.
2024-07-21 15:39:29 +02:00
parent c74ef48b40
commit 2906b56cd6
3 changed files with 4 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
shared/sandboxedprocessor.cpp
View File

@ -38,13 +38,11 @@ void SandboxedProcessor::enableSandbox(QString readablePath)
qCritical() << "Could not init exile" << Qt::endl;
exit(PROCESSFAIL);
}
policy->namespace_options = EXILE_UNSHARE_NETWORK | EXILE_UNSHARE_USER;
policy->namespace_options = 0;
std::string readablePathLocation;
if(!readablePath.isEmpty())
{
policy->namespace_options |= EXILE_UNSHARE_MOUNT;
policy->mount_path_policies_to_chroot = 1;
readablePathLocation = readablePath.toStdString();
if(exile_append_path_policies(policy, EXILE_FS_ALLOW_ALL_READ, readablePathLocation.c_str()) != 0)
{