diff options
author | 2020-02-27 19:55:52 +0100 | |
---|---|---|
committer | 2020-04-06 21:26:41 +0200 | |
commit | 0afb43a5607574fa946fdfd65f3a4cfa25cfa018 (patch) | |
tree | a09eb41b57cbecfccf6e284817d0043f0bbe0ab4 /mkasc.sh | |
parent | Add sbox_exec_v and SBOX_KEEP_FDS (diff) | |
download | firejail-0afb43a5607574fa946fdfd65f3a4cfa25cfa018.tar.gz firejail-0afb43a5607574fa946fdfd65f3a4cfa25cfa018.tar.zst firejail-0afb43a5607574fa946fdfd65f3a4cfa25cfa018.zip |
Add xdg-dbus-proxy support
* The proxy is forked off outside the sandbox namespace to protect the
fds of the original buses from the sandboxed process.
* The /run/firejail/dbus directory (with the sticky bit set) holds the proxy
sockets. The sockets are <parent pid>-user and <parent pid>-system for the
user and system buses, respectively. Each socket is owned by the sandbox user.
* The sockets are bind-mounted over their expected locations and the
/run/firejail/dbus directory is subsequently hidden from the sandbox.
* Upon sandbox exit, the xdg-dbus-proxy instance is terminated and the sockets
are cleaned up.
* Filter rules will be added in a future commit.
Diffstat (limited to 'mkasc.sh')
0 files changed, 0 insertions, 0 deletions