[PR #6429] [MERGED] profiles: blacklist sway IPC socket #6013

New issue

Closed

opened 2026-05-05 10:49:07 -06:00 by gitea-mirror · 0 comments

gitea-mirror commented

2026-05-05 10:49:07 -06:00

Owner

📋 Pull Request Information

Original PR: https://github.com/netblue30/firejail/pull/6429
Author: @qwertviop
Created: 8/1/2024
Status: ✅ Merged
Merged: 8/7/2024
Merged by: @undefined

Base: master ← Head: master

📝 Commits (1)

3769205 profiles: blacklist sway IPC socket

📊 Changes

2 files changed (+8 additions, -0 deletions)

View changed files

📝 etc/inc/disable-common.inc (+4 -0)
📝 etc/profile-m-z/sway.profile (+4 -0)

📄 Description

Much like the i3 IPC socket (#6361), the sway IPC socket also allows arbitrary code execution via the exec subcommand (i.e. swaymsg exec 'echo test > ~/test') . Access should only be permitted to sway itself by default.

The location of the IPC socket is set in sway/ipc-server.c:

	const char *dir = getenv("XDG_RUNTIME_DIR");
	if (!dir) {
		dir = "/tmp";
	}
	if (path_size <= snprintf(ipc_sockaddr->sun_path, path_size,
			"%s/sway-ipc.%u.%i.sock", dir, getuid(), getpid())) {
		sway_abort("Socket path won't fit into ipc_sockaddr->sun_path");
	}

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/netblue30/firejail/pull/6429 **Author:** [@qwertviop](https://github.com/qwertviop) **Created:** 8/1/2024 **Status:** ✅ Merged **Merged:** 8/7/2024 **Merged by:** [@undefined](undefined) **Base:** `master` ← **Head:** `master` --- ### 📝 Commits (1) - [`3769205`](https://github.com/netblue30/firejail/commit/37692052d8a2627a2d83d88eafa9318ba8d69284) profiles: blacklist sway IPC socket ### 📊 Changes **2 files changed** (+8 additions, -0 deletions) <details> <summary>View changed files</summary> 📝 `etc/inc/disable-common.inc` (+4 -0) 📝 `etc/profile-m-z/sway.profile` (+4 -0) </details> ### 📄 Description Much like the i3 IPC socket (#6361), the sway IPC socket also allows arbitrary code execution via the `exec` subcommand (i.e. `swaymsg exec 'echo test > ~/test'`) . Access should only be permitted to sway itself by default. The location of the IPC socket is set in [sway/ipc-server.c](https://github.com/swaywm/sway/blob/7e74a4914261cf32c45017521960adf7ff6dac8f/sway/ipc-server.c#L126): ``` const char *dir = getenv("XDG_RUNTIME_DIR"); if (!dir) { dir = "/tmp"; } if (path_size <= snprintf(ipc_sockaddr->sun_path, path_size, "%s/sway-ipc.%u.%i.sock", dir, getuid(), getpid())) { sway_abort("Socket path won't fit into ipc_sockaddr->sun_path"); } ``` --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

gitea-mirror

2026-05-05 10:49:07 -06:00

closed this issue
added the
pull-request
label

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#6013

No description provided.

Rows
Columns