diff options
| author |  Kristóf Marussy <kris7topher@gmail.com> | 2020-02-27 19:55:52 +0100 |
|---|---|---|
| committer | Kristóf Marussy <kris7topher@gmail.com> | 2020-04-06 21:26:41 +0200 |
| commit | 0afb43a5607574fa946fdfd65f3a4cfa25cfa018 (patch) | |
| tree | a09eb41b57cbecfccf6e284817d0043f0bbe0ab4 /src/man | |
| parent | Add sbox_exec_v and SBOX_KEEP_FDS (diff) | |
| download | firejail-0afb43a5607574fa946fdfd65f3a4cfa25cfa018.tar.gz firejail-0afb43a5607574fa946fdfd65f3a4cfa25cfa018.tar.zst firejail-0afb43a5607574fa946fdfd65f3a4cfa25cfa018.zip | |
Add xdg-dbus-proxy support
* The proxy is forked off outside the sandbox namespace to protect the
fds of the original buses from the sandboxed process.
* The /run/firejail/dbus directory (with the sticky bit set) holds the proxy
sockets. The sockets are <parent pid>-user and <parent pid>-system for the
user and system buses, respectively. Each socket is owned by the sandbox user.
* The sockets are bind-mounted over their expected locations and the
/run/firejail/dbus directory is subsequently hidden from the sandbox.
* Upon sandbox exit, the xdg-dbus-proxy instance is terminated and the sockets
are cleaned up.
* Filter rules will be added in a future commit.
Diffstat (limited to 'src/man')
0 files changed, 0 insertions, 0 deletions