From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:470:142:3::10]:37260) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1irAXv-0003o2-14 for guix-patches@gnu.org; Mon, 13 Jan 2020 19:59:04 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1irAXu-0005Vo-1N for guix-patches@gnu.org; Mon, 13 Jan 2020 19:59:02 -0500 Received: from debbugs.gnu.org ([209.51.188.43]:54487) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1irAXt-0005VR-U6 for guix-patches@gnu.org; Mon, 13 Jan 2020 19:59:01 -0500 Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1irAXt-0003dO-QY for guix-patches@gnu.org; Mon, 13 Jan 2020 19:59:01 -0500 Subject: [bug#39127] [PATCH] fixing icecat's multimedia Resent-Message-ID: Received: from eggs.gnu.org ([2001:470:142:3::10]:37195) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1irAXR-0003Ij-By for guix-patches@gnu.org; Mon, 13 Jan 2020 19:58:34 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1irAXQ-0004uK-4g for guix-patches@gnu.org; Mon, 13 Jan 2020 19:58:33 -0500 Received: from lepiller.eu ([2a00:5884:8208::1]:47000) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1irAXP-0004mM-Fo for guix-patches@gnu.org; Mon, 13 Jan 2020 19:58:32 -0500 Received: from lepiller.eu (localhost [127.0.0.1]) by lepiller.eu (OpenSMTPD) with ESMTP id e7eb96c2 for ; Tue, 14 Jan 2020 00:58:26 +0000 (UTC) Received: by lepiller.eu (OpenSMTPD) with ESMTPSA id d4020fb5 (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256:NO) for ; Tue, 14 Jan 2020 00:58:26 +0000 (UTC) Date: Tue, 14 Jan 2020 01:58:19 +0100 From: Julien Lepiller Message-ID: <20200114015819.713f4e4f@tachikoma.lepiller.eu> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="MP_/MlT0rDM8KC6EiIwySmyY3oV" List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-patches-bounces+kyle=kyleam.com@gnu.org Sender: "Guix-patches" To: 39127@debbugs.gnu.org --MP_/MlT0rDM8KC6EiIwySmyY3oV Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: quoted-printable Content-Disposition: inline =46rom IRC yesterday, I found that icecat was still missing something to properly read multimedia streams, like mp3/mp4. In the current version, it now tries to open ffmpeg's library dynamically, by looking in the store, instead of standard locations (/usr/lib etc). But this is not enough: even if icecat can properly find the library, it cannot load it because it uses a sandboxing feature that only allows it to read and write files from/to specific locations. /gnu/store is not part of them. Since icecat has access to /lib and /usr/lib, I think we can also give it read access (not write) to /gnu/store. This patch attempts to do just that, but I couldn't build icecat because of a lack of space. It sets the default security.sandbox.content.read_path_whitelist to /gnu/store/, the leading / meaning "and everything under it, recursively"). Wdyt? --MP_/MlT0rDM8KC6EiIwySmyY3oV Content-Type: text/x-patch Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=0001-gnu-icecat-Give-access-to-the-store-to-the-sandbox.patch >From adf7fdeffaa806edcd8abdac0746c06dad52c495 Mon Sep 17 00:00:00 2001 From: Julien Lepiller Date: Tue, 14 Jan 2020 01:48:42 +0100 Subject: [PATCH] gnu: icecat: Give access to the store to the sandbox. * gnu/packages/gnuzilla.scm (icecat): Add punch-hole-in-sandbox phase. --- gnu/packages/gnuzilla.scm | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/gnu/packages/gnuzilla.scm b/gnu/packages/gnuzilla.scm index 62b4390eab..14f446ee0a 100644 --- a/gnu/packages/gnuzilla.scm +++ b/gnu/packages/gnuzilla.scm @@ -971,6 +971,14 @@ from forcing GEXP-PROMISE." (("libavcodec\\.so") (string-append (assoc-ref inputs "ffmpeg") "/lib/libavcodec.so"))) #t)) + (add-after 'fix-ffmpeg-runtime-linker 'punch-hole-in-sandbox + (lambda _ + (substitute* "browser/app/profile/icecat.js" + (("\"security.sandbox.content.read_path_whitelist\", \"\"") + (string-append + "\"security.sandbox.content.read_path_whitelist\", \"" + (%store-directory) "/\""))) + #t)) (replace 'bootstrap (lambda _ (invoke "sh" "-c" "autoconf old-configure.in > old-configure") -- 2.24.0 --MP_/MlT0rDM8KC6EiIwySmyY3oV--