3 ms·
Do you mean you don't trust it? Because they do describe its sandboxing as a security feature.
by mikedelfino 2y ago
Do you mean you don't trust it? Because they do describe its sandboxing as a security feature.
- EasyMark 2y agorepeated myself somehow
- EasyMark 2y agoflatpak or firejail would have protected you from this vulnerability, not sure what they're on about here. They are 100% proof against everything of course.
- nullc 2y agoThe firefox flatpak has write access to your home directory. So it can simply edit your bashrc even if there are no more direct escapes, no?
- mikedelfino 2y agoFirefox Flatpak has neither write or read permission to your home directory. At least that's my take from browsing file:///home/myuser. If you try to open or save a file using the native dialogs, you do grant the appropriate permission on demand, but that's using the xdg portal, outside the app scope, specifically designed for this.
- nullc 2y agoit's easy for something with arbitrary code execution to escape the sandboxing. https://hanako.codeberg.page/ https://hanako.codeberg.page/
- mikedelfino 2y agoI couldn't reproduce the tty example, but it might as well be a mistake on my side. Other than this, the sandboxing spec itself is as safe as I'd expect. I reckon that Wayland applications not packaged to require $HOME access or some dbus services are not known to escape the sandbox. This seems to be the case of Firefox, afaict.