sandboxing: Disable mechanisms requiring namespaces

Needs detection whether we have them available at some point, especially
since Ubuntu 24.04 blocks them with Apparmor. But for now, don't unshare
anything.

submodules: exile.h: Sync
这个提交包含在:
2024-07-21 15:39:29 +02:00
父节点 c74ef48b40
当前提交 2906b56cd6
共有 3 个文件被更改,包括 4 次插入7 次删除

查看文件

@@ -38,13 +38,11 @@ void SandboxedProcessor::enableSandbox(QString readablePath)
qCritical() << "Could not init exile" << Qt::endl;
exit(PROCESSFAIL);
}
policy->namespace_options = EXILE_UNSHARE_NETWORK | EXILE_UNSHARE_USER;
policy->namespace_options = 0;
std::string readablePathLocation;
if(!readablePath.isEmpty())
{
policy->namespace_options |= EXILE_UNSHARE_MOUNT;
policy->mount_path_policies_to_chroot = 1;
readablePathLocation = readablePath.toStdString();
if(exile_append_path_policies(policy, EXILE_FS_ALLOW_ALL_READ, readablePathLocation.c_str()) != 0)
{