improve sandboxing of KDE apps: set KDE_FORK_SLAVES, blacklist slave-sockets

setting the KDE_FORK_SLAVES environment variable removes all inconsistencies
that arise from slaves running outside the sandbox or in a different sandbox;
it also makes it slightly more difficult to abuse KIO in general and helps to
mitigate security problems due to thumbnailing, which now always happens inside
the same sandbox. The trade-off is more concurrently running slave processes.

closes #2285

2 files changed, 12 insertions, 5 deletions

diff --git a/etc/disable-common.inc b/etc/disable-common.inc
index 74b653385..481717d24 100644
--- a/etc/disable-common.inc
+++ b/etc/disable-common.inc
@@ -118,11 +118,14 @@ read-only ${HOME}/.local/share/konsole
 read-only ${HOME}/.local/share/kservices5
 read-only ${HOME}/.local/share/kssl
 
-# kdeinit socket
-blacklist /run/user/*/kdeinit5__*
-# blacklist /run/user/*/ksocket-*/kdeinit4__*
-# blacklist /tmp/ksocket-*/kdeinit4__*
-# causes issues when kdeinit4 gets killed; enable on KDE Plasma 4
+# KDE sockets
+blacklist ${RUNUSER}/kdeinit5__*
+blacklist ${RUNUSER}/*.slave-socket
+# decide heuristically if the kdeinit4 socket can be blacklisted
+?HAS_NODBUS: blacklist ${RUNUSER}/ksocket-*/kdeinit4__*
+blacklist ${RUNUSER}/ksocket-*/*.slave-socket
+?HAS_NODBUS: blacklist /tmp/ksocket-*/kdeinit4__*
+blacklist /tmp/ksocket-*/*.slave-socket
 
 # gnome
 # contains extensions, last used times of applications, and notifications
diff --git a/src/firejail/env.c b/src/firejail/env.c
index a09be8a77..fd4bfbd57 100644
--- a/src/firejail/env.c
+++ b/src/firejail/env.c
@@ -132,6 +132,10 @@ void env_defaults(void) {
         if (cfg.shell && setenv("SHELL", cfg.shell, 1) < 0)
                 errExit("setenv");
 
+        // spawn KIO slaves inside the sandbox
+        if (setenv("KDE_FORK_SLAVES", "1", 1) < 0)
+                errExit("setenv");
+
         // set prompt color to green
         int set_prompt = 0;
         if (checkcfg(CFG_FIREJAIL_PROMPT))