From: Mark H Weaver <mhw@netris.org>
To: Efraim Flashner <efraim@flashner.co.il>,
Guillaume Le Vaillant <glv@posteo.net>
Cc: 47628@debbugs.gnu.org
Subject: bug#47628: webkitgtk-2.32.0 fails to launch without /usr/bin
Date: Thu, 08 Apr 2021 11:07:31 -0400 [thread overview]
Message-ID: <878s5solv5.fsf@netris.org> (raw)
In-Reply-To: <87blaoonha.fsf@netris.org>
I suspect that the relevant bit that needs to be changed is line 779 of
the following file in the webkitgtk-2.32.0 source code:
Source/WebKit/UIProcess/Launcher/glib/BubblewrapLauncher.cpp
Most likely, that line can simply be deleted. Here's the relevant
excerpt, with line 779 marked by "==>":
--8<---------------cut here---------------start------------->8---
GRefPtr<GSubprocess> bubblewrapSpawn(GSubprocessLauncher* launcher, const ProcessLauncher::LaunchOptions& launchOptions, char** argv, GError **error)
{
ASSERT(launcher);
// For now we are just considering the network process trusted as it
// requires a lot of access but doesn't execute arbitrary code like
// the WebProcess where our focus lies.
if (launchOptions.processType == ProcessLauncher::ProcessType::Network)
return adoptGRef(g_subprocess_launcher_spawnv(launcher, argv, error));
const char* runDir = g_get_user_runtime_dir();
Vector<CString> sandboxArgs = {
"--die-with-parent",
"--unshare-pid",
"--unshare-uts",
// We assume /etc has safe permissions.
// At a later point we can start masking privacy-concerning files.
"--ro-bind", "/etc", "/etc",
"--dev", "/dev",
"--proc", "/proc",
"--tmpfs", "/tmp",
"--unsetenv", "TMPDIR",
"--dir", runDir,
"--setenv", "XDG_RUNTIME_DIR", runDir,
"--symlink", "../run", "/var/run",
"--symlink", "../tmp", "/var/tmp",
"--ro-bind", "/sys/block", "/sys/block",
"--ro-bind", "/sys/bus", "/sys/bus",
"--ro-bind", "/sys/class", "/sys/class",
"--ro-bind", "/sys/dev", "/sys/dev",
"--ro-bind", "/sys/devices", "/sys/devices",
"--ro-bind-try", "/usr/share", "/usr/share",
"--ro-bind-try", "/usr/local/share", "/usr/local/share",
"--ro-bind-try", DATADIR, DATADIR,
// Bind mount the store inside the WebKitGTK sandbox.
"--ro-bind", "@storedir@", "@storedir@",
// We only grant access to the libdirs webkit is built with and
// guess system libdirs. This will always have some edge cases.
"--ro-bind-try", "/lib", "/lib",
"--ro-bind-try", "/usr/lib", "/usr/lib",
"--ro-bind-try", "/usr/local/lib", "/usr/local/lib",
"--ro-bind-try", LIBDIR, LIBDIR,
"--ro-bind-try", "/lib64", "/lib64",
"--ro-bind-try", "/usr/lib64", "/usr/lib64",
"--ro-bind-try", "/usr/local/lib64", "/usr/local/lib64",
"--ro-bind-try", PKGLIBEXECDIR, PKGLIBEXECDIR,
};
if (launchOptions.processType == ProcessLauncher::ProcessType::DBusProxy) {
sandboxArgs.appendVector(Vector<CString>({
==> "--ro-bind", "/usr/bin", "/usr/bin",
// This is a lot of access, but xdg-dbus-proxy is trusted so that's OK. It's sandboxed
// only because we have to mount .flatpak-info in its mount namespace. The user rundir
// is where we mount our proxy socket.
"--bind", runDir, runDir,
}));
} else {
// xdg-dbus-proxy needs access to host abstract sockets to connect to the a11y bus. Secure
// host services must not use abstract sockets. Otherwise, only the network process should
// have network access, and the network process is not sandboxed at all.
sandboxArgs.appendVector(Vector<CString>({
"--unshare-net"
}));
}
--8<---------------cut here---------------end--------------->8---
Mark
next prev parent reply other threads:[~2021-04-08 15:10 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-04-06 22:46 bug#47628: Epiphany fails to launch after webkitgtk-2.32.0 update Mark H Weaver
2021-04-06 23:04 ` bug#47628: webkitgtk-2.32.0 is broken on my system (was Re: bug#47628: Epiphany fails to launch after webkitgtk-2.32.0 update) Mark H Weaver
2021-04-07 7:35 ` bug#47628: webkitgtk-2.32.0 is broken on my system Guillaume Le Vaillant
2021-04-08 8:22 ` Efraim Flashner
2021-04-08 14:19 ` bug#47628: webkitgtk-2.32.0 fails to launch without /usr/bin/env Mark H Weaver
2021-04-08 14:32 ` bug#47628: webkitgtk-2.32.0 fails to launch without /usr/bin Mark H Weaver
2021-04-08 15:07 ` Mark H Weaver [this message]
2021-04-09 10:09 ` Efraim Flashner
2021-04-13 19:22 ` Mark H Weaver
2021-04-14 15:22 ` Efraim Flashner
2022-03-18 2:47 ` Maxim Cournoyer
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=878s5solv5.fsf@netris.org \
--to=mhw@netris.org \
--cc=47628@debbugs.gnu.org \
--cc=efraim@flashner.co.il \
--cc=glv@posteo.net \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this external index
https://git.savannah.gnu.org/cgit/guix.git
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.