4 ms·
Using fork and exec with a pipe is not going to work within a sandbox. That "cruft" is necessary for the thing to work...
by BrightGlow 5y ago
Using fork and exec with a pipe is not going to work within a sandbox. That "cruft" is necessary for the thing to work...
- Cloudef 5y agoI get why they invented this for flatpak (Even though it still could be done with processes and namespaces), but my original point was wondering why they did not originally use fork, exec and pipe.
- BrightGlow 5y agoBecause the goal was to make an API that works the same both inside the sandbox and outside the sandbox. Edit: It wouldn't work with just processes and namespaces because you need a way to talk to a resource with a privilege level above the current mount namespace.
- Cloudef 5y agoRight, the child process can't escape the sandbox. I guess IPC here is the only sane choice.