improve sandboxing of KDE apps: set KDE_FORK_SLAVES, blacklist slave-sockets

setting the KDE_FORK_SLAVES environment variable removes all inconsistencies
that arise from slaves running outside the sandbox or in a different sandbox;
it also makes it slightly more difficult to abuse KIO in general and helps to
mitigate security problems due to thumbnailing, which now always happens inside
the same sandbox. The trade-off is more concurrently running slave processes.

closes #2285

1 files changed, 4 insertions, 0 deletions

diff --git a/src/firejail/env.c b/src/firejail/env.c
index a09be8a77..fd4bfbd57 100644
--- a/src/firejail/env.c
+++ b/src/firejail/env.c
@@ -132,6 +132,10 @@ void env_defaults(void) {
         if (cfg.shell && setenv("SHELL", cfg.shell, 1) < 0)
                 errExit("setenv");
 
+        // spawn KIO slaves inside the sandbox
+        if (setenv("KDE_FORK_SLAVES", "1", 1) < 0)
+                errExit("setenv");
+
         // set prompt color to green
         int set_prompt = 0;
         if (checkcfg(CFG_FIREJAIL_PROMPT))