capsicumizer: sandboxing (GUI) apps on FreeBSD with external profiles
source link: https://www.tuicool.com/articles/hit/QJVvyif
Go to the source link to view the article. You can view the picture content, updated content and better typesetting reading experience. If the link is broken, please click the button below to view the snapshot at that time.
The Super Capsicumizer 9000
capsicumizer
is a sandbox launcher that imposes Capsicum capability mode onto an unsuspecting program, allowing "sysadmin style" or " oblivious " sandboxing (i.e. no source code modifications, all restrictions added externally).
You just write AppArmor-esque "profiles" and capsicumizer
takes care of sandboxing the applications.
capsicumizer
is capable of launching some GUI applications (like gedit) on both Wayland and X11.
(GTK 3.24 required because of this patch )
Note: applications that use syscalls directly (instead of going through libc
) — namely, anything compiled with Golang's official compiler — won't be able to actually access files under the allowed paths. This is because we rely on LD_PRELOAD
ing a library ( libpreopen ) that overrides libc functions like open
to make them use openat
style functions with pre-opened directory descriptors.
Requirements
- a recent version of FreeBSD
- Meson build system
- libucl >=0.8.1 (pkg: # 233383 )
- libpreopen (that linked fork, at least for now) (pkg: someday)
Usage
Capsicumizer profiles are written in UCL syntax (which is pretty common on FreeBSD), and can be used as directly runnable scripts ( #!
):
#!/usr/bin/env capsicumizer run = "/usr/local/bin/gedit"; access_path = [ "$HOME", "/usr/local", "/var/db/fontconfig", "/tmp", ]; library_path = [ "/lib", "/usr/lib", "/usr/local/lib", "/usr/local/lib/gvfs", "/usr/local/lib/gio/modules", "/usr/local/lib/gedit", ]; # gedit does not need any extra preloads # this is just an example ld_preload = [ "libgobject-2.0.so" ];
Environment variables are exposed as UCL variables.
Contributing
By participating in this project you agree to follow the Contributor Code of Conduct .
The list of contributors is available on GitHub .
License
This is free and unencumbered software released into the public domain.
For more information, please refer to the UNLICENSE
file or unlicense.org .
Recommend
About Joyk
Aggregate valuable and interesting links.
Joyk means Joy of geeK