github-starred/firejail
2
0
Fork 0
mirror of https://github.com/netblue30/firejail.git synced 2026-05-21 06:45:29 -06:00
Code Issues 531 Projects Packages Wiki Activity Actions 1

profiles: blacklist sway IPC socket (#6429)

Browse source 
Much like the i3 IPC socket (#6361), the sway IPC socket also allows
arbitrary code execution via the `exec` subcommand. Access should only
be permitted to sway itself by default.

The location of the IPC socket is set in sway/ipc-server.c:

7e74a49142/sway/ipc-server.c (L126)
This commit is contained in:
Felix Pehla 2024-08-07 03:26:04 +02:00 • committed by GitHub
parent 7031de4f54
commit de85522248
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 8 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

4
etc/inc/disable-common.inc
View file

@ -171,6 +171,10 @@ blacklist ${RUNUSER}/gsconnect
blacklist ${RUNUSER}/i3/ipc-socket.*
blacklist /tmp/i3-*/ipc-socket.*
# sway IPC socket (allows arbitrary shell script execution)
blacklist ${RUNUSER}/sway-ipc.*
blacklist /tmp/sway-ipc.*
# systemd
blacklist ${HOME}/.config/systemd
blacklist ${HOME}/.local/share/systemd

4
etc/profile-m-z/sway.profile
View file

@ -10,6 +10,10 @@ include globals.local
noblacklist ${HOME}/.config/sway
# sway uses ~/.config/i3 as fallback if there is no ~/.config/sway
noblacklist ${HOME}/.config/i3
# allow creation of IPC socket
noblacklist ${RUNUSER}/sway-ipc.*
noblacklist /tmp/sway-ipc.*
include disable-common.inc
caps.drop all