diff options
author | Felix Pehla <74104874+FelixPehla@users.noreply.github.com> | 2024-08-07 03:26:04 +0200 |
---|---|---|
committer | GitHub <noreply@github.com> | 2024-08-07 01:26:04 +0000 |
commit | de855222487b9633c3833a4d0ef77558c52b8e5b (patch) | |
tree | d207284b2f53274373b67da6c9909b58c2007595 /etc | |
parent | build(deps): bump step-security/harden-runner from 2.8.1 to 2.9.0 (diff) | |
download | firejail-de855222487b9633c3833a4d0ef77558c52b8e5b.tar.gz firejail-de855222487b9633c3833a4d0ef77558c52b8e5b.tar.zst firejail-de855222487b9633c3833a4d0ef77558c52b8e5b.zip |
profiles: blacklist sway IPC socket (#6429)
Much like the i3 IPC socket (#6361), the sway IPC socket also allows
arbitrary code execution via the `exec` subcommand. Access should only
be permitted to sway itself by default.
The location of the IPC socket is set in sway/ipc-server.c:
https://github.com/swaywm/sway/blob/7e74a4914261cf32c45017521960adf7ff6dac8f/sway/ipc-server.c#L126
Diffstat (limited to 'etc')
-rw-r--r-- | etc/inc/disable-common.inc | 4 | ||||
-rw-r--r-- | etc/profile-m-z/sway.profile | 4 |
2 files changed, 8 insertions, 0 deletions
diff --git a/etc/inc/disable-common.inc b/etc/inc/disable-common.inc index 14f7d8cf7..faae99543 100644 --- a/etc/inc/disable-common.inc +++ b/etc/inc/disable-common.inc | |||
@@ -171,6 +171,10 @@ blacklist ${RUNUSER}/gsconnect | |||
171 | blacklist ${RUNUSER}/i3/ipc-socket.* | 171 | blacklist ${RUNUSER}/i3/ipc-socket.* |
172 | blacklist /tmp/i3-*/ipc-socket.* | 172 | blacklist /tmp/i3-*/ipc-socket.* |
173 | 173 | ||
174 | # sway IPC socket (allows arbitrary shell script execution) | ||
175 | blacklist ${RUNUSER}/sway-ipc.* | ||
176 | blacklist /tmp/sway-ipc.* | ||
177 | |||
174 | # systemd | 178 | # systemd |
175 | blacklist ${HOME}/.config/systemd | 179 | blacklist ${HOME}/.config/systemd |
176 | blacklist ${HOME}/.local/share/systemd | 180 | blacklist ${HOME}/.local/share/systemd |
diff --git a/etc/profile-m-z/sway.profile b/etc/profile-m-z/sway.profile index f71905150..b7f90f6ad 100644 --- a/etc/profile-m-z/sway.profile +++ b/etc/profile-m-z/sway.profile | |||
@@ -10,6 +10,10 @@ include globals.local | |||
10 | noblacklist ${HOME}/.config/sway | 10 | noblacklist ${HOME}/.config/sway |
11 | # sway uses ~/.config/i3 as fallback if there is no ~/.config/sway | 11 | # sway uses ~/.config/i3 as fallback if there is no ~/.config/sway |
12 | noblacklist ${HOME}/.config/i3 | 12 | noblacklist ${HOME}/.config/i3 |
13 | # allow creation of IPC socket | ||
14 | noblacklist ${RUNUSER}/sway-ipc.* | ||
15 | noblacklist /tmp/sway-ipc.* | ||
16 | |||
13 | include disable-common.inc | 17 | include disable-common.inc |
14 | 18 | ||
15 | caps.drop all | 19 | caps.drop all |