~ruther/guix-local

ref: bc2e049af14cd9a25b9571e79f1c5e6c97c5f742 guix-local/gnu/packages/patches/torbrowsers-add-store-to-rdd-allowlist.patch -rw-r--r-- 2.2 KiB
bc2e049a — Sharlatan Hellseher gnu: Remove python-nose-exclude. 7 months ago 
                                                                                
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51

By default Firefox sandbox security model allows browser components to
access files under '/usr', '/etc' and user home directories.  However,
similar to Nix, on Guix some of those file hierarchies are actually
symlinks to '/gnu/store' paths, which then get denied, breaking some
expected functionality on the browser.  Moreover, their final store
paths are not available on the build environment and also expected to
change.

Guix users that are willing to further restrict browsers' access to their
file systems and do not mind losing some funcionality are advised to use
Guix Containers.

See: <https://bugzilla.mozilla.org/show_bug.cgi?id=1848615#c8>,
<https://codeberg.org/guix/guix/issues/661>,
<https://issues.guix.gnu.org/38045> and
<https://issues.guix.gnu.org/77559>

--- a/security/sandbox/linux/broker/SandboxBrokerPolicyFactory.cpp
+++ b/security/sandbox/linux/broker/SandboxBrokerPolicyFactory.cpp
@@ -452,6 +452,7 @@
   // Various places where fonts reside
   policy->AddDir(rdonly, "/usr/X11R6/lib/X11/fonts");
   policy->AddDir(rdonly, "/nix/store");
+  policy->AddDir(rdonly, "/gnu/store");
   // https://gitlab.com/freedesktop-sdk/freedesktop-sdk/-/blob/e434e680d22260f277f4a30ec4660ed32b591d16/files/fontconfig-flatpak.conf
   policy->AddDir(rdonly, "/run/host/fonts");
   policy->AddDir(rdonly, "/run/host/user-fonts");
@@ -461,6 +462,7 @@
   // Bug 1848615
   policy->AddPath(rdonly, "/usr");
   policy->AddPath(rdonly, "/nix");
+  policy->AddPath(rdonly, "/gnu");
 
   AddLdconfigPaths(policy);
   AddLdLibraryEnvPaths(policy);
@@ -920,6 +922,7 @@
   policy->AddDir(rdonly, "/usr/lib64");
   policy->AddDir(rdonly, "/run/opengl-driver/lib");
   policy->AddDir(rdonly, "/nix/store");
+  policy->AddDir(rdonly, "/gnu/store");
 
   // Bug 1647957: memory reporting.
   AddMemoryReporting(policy.get(), aPid);
@@ -1043,6 +1046,7 @@
   // Required to make sure ffmpeg loads properly, this is already existing on
   // Content and RDD
   policy->AddDir(rdonly, "/nix/store");
+  policy->AddDir(rdonly, "/gnu/store");
 
   // glibc will try to stat64("/") while populating nsswitch database
   // https://sourceware.org/git/?p=glibc.git;a=blob;f=nss/nss_database.c;h=cf0306adc47f12d9bc761ab1b013629f4482b7e6;hb=9826b03b747b841f5fc6de2054bf1ef3f5c4bdf3#l396