Add xdg-dbus-proxy support

* The proxy is forked off outside the sandbox namespace to protect the
  fds of the original buses from the sandboxed process.
* The /run/firejail/dbus directory (with the sticky bit set) holds the proxy
  sockets. The sockets are <parent pid>-user and <parent pid>-system for the
  user and system buses, respectively. Each socket is owned by the sandbox user.
* The sockets are bind-mounted over their expected locations and the
  /run/firejail/dbus directory is subsequently hidden from the sandbox.
* Upon sandbox exit, the xdg-dbus-proxy instance is terminated and the sockets
  are cleaned up.
* Filter rules will be added in a future commit.

1 files changed, 1 insertions, 0 deletions

diff --git a/src/include/rundefs.h b/src/include/rundefs.h
index 32f5ff12c..528d9e901 100644
--- a/src/include/rundefs.h
+++ b/src/include/rundefs.h
@@ -30,6 +30,7 @@
 #define RUN_FIREJAIL_NETWORK_DIR        RUN_FIREJAIL_DIR "/network"
 #define RUN_FIREJAIL_BANDWIDTH_DIR      RUN_FIREJAIL_DIR "/bandwidth"
 #define RUN_FIREJAIL_PROFILE_DIR        RUN_FIREJAIL_DIR "/profile"
+#define RUN_FIREJAIL_DBUS_DIR RUN_FIREJAIL_DIR "/dbus"
 #define RUN_NETWORK_LOCK_FILE           RUN_FIREJAIL_DIR "/firejail-network.lock"
 #define RUN_DIRECTORY_LOCK_FILE         RUN_FIREJAIL_DIR "/firejail-run.lock"
 #define RUN_RO_DIR                      RUN_FIREJAIL_DIR "/firejail.ro.dir"