Add xdg-dbus-proxy support

* The proxy is forked off outside the sandbox namespace to protect the
  fds of the original buses from the sandboxed process.
* The /run/firejail/dbus directory (with the sticky bit set) holds the proxy
  sockets. The sockets are <parent pid>-user and <parent pid>-system for the
  user and system buses, respectively. Each socket is owned by the sandbox user.
* The sockets are bind-mounted over their expected locations and the
  /run/firejail/dbus directory is subsequently hidden from the sandbox.
* Upon sandbox exit, the xdg-dbus-proxy instance is terminated and the sockets
  are cleaned up.
* Filter rules will be added in a future commit.

1 files changed, 2 insertions, 0 deletions

diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
index d35e0d155..36ffd89b6 100644
--- a/src/firejail/firejail.h
+++ b/src/firejail/firejail.h
@@ -846,6 +846,8 @@ void set_x11_run_file(pid_t pid, int display);
 void set_profile_run_file(pid_t pid, const char *fname);
 
 // dbus.c
+void dbus_proxy_start(void);
+void dbus_proxy_stop(void);
 void dbus_apply_policy(void);
 
 // dhcp.c