Page MenuHomeSolus
Differential D7751

Enable subprocess sandboxing for libwebkit-gtk
Needs ReviewPublic
Actions

Authored by Jacalz on Sat, Nov 30, 2:57 PM.

Details

Reviewers
None
Group Reviewers
Triage Team
Summary

Packaging Changes:

  • Build with bubbelwrap sandbox to support running subprocesses in a sandbox. This should (in theory) lead to better web security for applications leveraging libwebkit-gtk.

Depends on D7750

Test Plan
  • Browse different sites to verify that everything works as expected.
  • Verify that performace doesn't regress with running sandboxed compared to running without.

Diff Detail

Repository
R3336 libwebkit-gtk
Branch
master
Lint
No Linters Available
Unit
No Unit Test Coverage

Event Timeline

Jacalz created this revision.Sat, Nov 30, 2:57 PM
Jacalz requested review of this revision.Sat, Nov 30, 2:57 PM
JoshStrobl added a subscriber: JoshStrobl.Wed, Dec 4, 8:11 AM

Build with bubbelwrap sandbox. This should lead to better web security for applications leveraging webkit-gtk.

So how are we testing that we're actually running these webkit instances in a sandboxed environment?

Jacalz added a comment.Wed, Dec 4, 4:13 PM
In D7751#124126, @JoshStrobl wrote:

Build with bubbelwrap sandbox. This should lead to better web security for applications leveraging webkit-gtk.

So how are we testing that we're actually running these webkit instances in a sandboxed environment?

Well, I haven't find any good way to test it. Can't possibly be less secure than without it though.

Jacalz edited the summary of this revision. (Show Details)Wed, Dec 4, 4:13 PM
Jacalz retitled this revision from Make libwebkit-gtk sandboxed to Enable subprocess sandboxing for libwebkit-gtk.Thu, Dec 5, 6:06 PM
Jacalz edited the summary of this revision. (Show Details)
JoshStrobl added a comment.Thu, Dec 5, 9:16 PM
In D7751#124213, @Jacalz wrote:
In D7751#124126, @JoshStrobl wrote:

Build with bubbelwrap sandbox. This should lead to better web security for applications leveraging webkit-gtk.

So how are we testing that we're actually running these webkit instances in a sandboxed environment?

Well, I haven't find any good way to test it. Can't possibly be less secure than without it though.

Well unless you have a way to verifiably ensure it even works in the first place, it isn't any more secure, which is the point of it.

Revision Contents
Changeset List

PathPackages
Mabi_used_libs (1 line)
Mpackage.yml (9 lines)
Mpspec_x86_64.xml (14 lines)

Diff 18600

View Options

abi_used_libs

Loading...
View Options

package.yml

Loading...
View Options

pspec_x86_64.xml

Loading...
Copyright © 2015-2019 Solus Project. The Solus logo is Copyright © 2016-2019 Solus Project. All Rights Reserved.