security-context-v1 support

[AR-CADE]

hi,
i have a simple question...

is there any plan to add security-context-v1 support to bubblewrap ?

thanks in advance for your awnser.

[smcv]

is there any plan to add security-context-v1 support to bubblewrap ?

I'm not aware of any plan to make bubblewrap connect to a Wayland compositor and create new Wayland connections for the sandboxed program using the security-context-v1 protocol, if that's what you mean?

It's generally more appropriate for that sort of thing to be done by a "larger" component, like Flatpak (which uses bubblewrap, and does support the Wayland security-context-v1 protocol since flatpak/flatpak#4920). In Flatpak, this works by creating the new Wayland server outside the sandbox, and then bind-mounting its socket into the sandbox instead of the original Wayland socket.

Because bubblewrap is (still) sometimes installed setuid-root, every feature it has and every library it links is attack surface for a potential root privilege-escalation flaw, so things that don't need to be done by bubblewrap shouldn't be done by bubblewrap.

This is similar to the way that bubblewrap supports adding seccomp filters, but it doesn't link to libseccomp and compile seccomp filters from human-readable instructions. Instead, a larger component (like Flatpak or glycin) needs to compile the seccomp filter, and pass it down to bubblewrap as a binary blob.

[AR-CADE]

Well, thanks for the quick and honest answer...

[learnwayback]

https://git.sr.ht/~whynothugo/way-secure