README.md

@@ -76,7 +76,7 @@ To build on Ubuntu and Debian, clone the repo and then run:
 ```
 git submodule init
 git submodule update
-sudo apt install build-essential qt6-base-dev libqt6sql6-sqlite libpoppler-qt6-dev libuchardet-dev libquazip1-qt6-dev
+sudo apt install build-essential qtbase5-dev libqt5sql5-sqlite libpoppler-qt5-dev libuchardet-dev libquazip5-dev
 qmake
 make
 ```

gui/main.cpp

@@ -25,10 +25,11 @@ void enableIpcSandbox()
 		qCritical() << "Failed to init policy for sandbox";
 		exit(EXIT_FAILURE);
 	}
-	policy->namespace_options = 0;
+	policy->namespace_options = EXILE_UNSHARE_USER | EXILE_UNSHARE_MOUNT | EXILE_UNSHARE_NETWORK;
 	policy->no_new_privs = 1;
-	policy->drop_caps = 0;
+	policy->drop_caps = 1;
 	policy->vow_promises = exile_vows_from_str("thread cpath rpath wpath unix stdio proc error");
+	policy->mount_path_policies_to_chroot = 1;
 
 	QString ipcSocketPath = Common::ipcSocketPath();
 	QFileInfo info{ipcSocketPath};

shared/sandboxedprocessor.cpp

@@ -36,18 +36,20 @@ void SandboxedProcessor::enableSandbox(QString readablePath)
 	if(policy == NULL)
 	{
 		qCritical() << "Could not init exile" << Qt::endl;
-		exit(PROCESSFAIL);
+		exit(EXIT_FAILURE);
 	}
-	policy->namespace_options = 0;
+	policy->namespace_options = EXILE_UNSHARE_NETWORK | EXILE_UNSHARE_USER;
 
 	std::string readablePathLocation;
 	if(!readablePath.isEmpty())
 	{
+		policy->namespace_options |= EXILE_UNSHARE_MOUNT;
+		policy->mount_path_policies_to_chroot = 1;
 		readablePathLocation = readablePath.toStdString();
 		if(exile_append_path_policies(policy, EXILE_FS_ALLOW_ALL_READ, readablePathLocation.c_str()) != 0)
 		{
 			qCritical() << "Failed to add path policies";
-			exit(PROCESSFAIL);
+			exit(EXIT_FAILURE);
 		}
 	}
 	else
@@ -58,7 +60,7 @@ void SandboxedProcessor::enableSandbox(QString readablePath)
 	if(ret != 0)
 	{
 		qCritical() << "Failed to establish sandbox: " << ret;
-		exit(PROCESSFAIL);
+		exit(EXIT_FAILURE);
 	}
 	exile_free_policy(policy);
 }

submodules/exile.h

@@ -1 +1 @@
-Subproject commit 4cfdead5d0d2cb4ecee4e5e654e8e90dda683744
+Subproject commit 44b9a17becf6882e1b3728cbf885ae9e5a6717af