From: Jack Hill <jackhill@jackhill.us>
To: Marius Bakke <mbakke@fastmail.com>
Cc: sirgazil <sirgazil@zoho.com>, 40837 <40837@debbugs.gnu.org>
Subject: bug#40837: core-updates: webkitgtk web process sandbox incomplete
Date: Wed, 6 May 2020 16:17:58 -0400 (EDT) [thread overview]
Message-ID: <alpine.DEB.2.20.2005061607510.5735@marsh.hcoop.net> (raw)
In-Reply-To: <87h7wt3tmv.fsf@devup.no>
On Wed, 6 May 2020, Marius Bakke wrote:
> Hello Jack,
>
> Thanks a lot for this work.
You're welcome. I'm happy that we seem to be making good progress.
> Jack Hill <jackhill@jackhill.us> writes:
>
>> Some additional observations:
>>
>> With my patched webkitgtk, if I set:
>>
>> PULSE_CLIENTCONFIG=/gnu/store/zc4dsmvdabi00nvisrjhi9w00ff4igs7-client.conf
>>
>> it does work, which is an improvement compared to without the patch.
>
> Great. I have attached a patch for Guix that stops using /etc for these
> variables.
Good idea! That way we won't have to wait for WebKitGTK to canonicalize
all paths :)
>> [0] https://github.com/NixOS/nixpkgs/blob/465566948393cf533e3617704d1c4ccc34cf3753/pkgs/development/libraries/webkitgtk/fix-bubblewrap-paths.patch
>>
>> so I wonder if I didn't do the mounts in the right place and or if it is
>> becasue I missed /run/current-system.
>>
>> I'm going to try to adapt the Nix patch to see if that helps.
>
> Were you able to verify whether /run/current-system is required inside
> the sandbox?
I don't think /run/current-system is needed.
> I cleaned up your patch a bit and rebased it on the latest master
> branch, available as patch 2/2 below. Currently building it on
> 'core-updates' to verify that it works. It takes a while on my dinky
> quad-core server though. :-)
>
> It does not bind /run/current-system, and I think we should avoid it if
> possible. Ideally we would only mount the store paths required by the
> consumers instead of all of /gnu/store, but not sure how to achieve
> that.
I've tested the updated patch by applying it to master and merging into
core-updates. I'm happy to report that everything seems to be working for
me after doing so!
Sharing less than the whole store sounds like a great aspiration, but I
think we'd have to teach WebKitGTK how to ask Guix for its closure to do
so. On FHS-compliant systems, all of the various /usr/lib and /usr/share
directories are bind-mounted into the new namespace, so I don't think
we're providing too much more. It's nice that our setuid binaries reside
outside of the store :)
Best,
Jack
next prev parent reply other threads:[~2020-05-06 20:19 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-04-25 2:55 bug#40837: core-updates: epiphany web process crashes Jack Hill
2020-04-25 3:19 ` Jack Hill
2020-04-25 21:55 ` sirgazil via Bug reports for GNU Guix
2020-04-26 1:23 ` Jack Hill
2020-04-26 1:46 ` Jack Hill
2020-04-26 3:03 ` Jack Hill
2020-04-26 20:42 ` bug#40837: core-updates: webkitgtk web process sandbox incomplete Jack Hill
2020-04-27 22:02 ` Jack Hill
2020-04-28 3:03 ` Jack Hill
2020-04-28 16:27 ` Jack Hill
2020-04-28 16:33 ` sirgazil via Bug reports for GNU Guix
2020-05-06 16:39 ` Marius Bakke
2020-05-06 20:17 ` Jack Hill [this message]
2020-05-06 20:53 ` Marius Bakke
2020-05-04 19:27 ` bug#40837: (no subject) sirgazil via web
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=alpine.DEB.2.20.2005061607510.5735@marsh.hcoop.net \
--to=jackhill@jackhill.us \
--cc=40837@debbugs.gnu.org \
--cc=mbakke@fastmail.com \
--cc=sirgazil@zoho.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this external index
https://git.savannah.gnu.org/cgit/guix.git
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.