-----BEGIN PGP SIGNED MESSAGE-----
On 04/15/2011 09:08 AM, Christoph A. wrote:
On 09/12/2010 02:54 PM, Christoph A. wrote:
> I was using firefox within sandboxes for a while without perm. home
> To store bookmarks, addons and so on, I started to use perm. homedir (-H).
> Because firefox does not allow multiple concurrent sessions (lock on
> .mozilla) it is not possible to open multiple websites when specifying
> the same sandbox homedir, hence I'm looking for a possibility to open
> new websites within a running sandbox from outside.
> Without sandboxes everyone can open new websites in a running firefox
> instance using:
> firefox -remote "openurl(http://www.mozilla.org)"
> sandbox scenario:
> 1. step:
> start firefox:
> sandbox -X -H homedir -T tempdir -t sandbox_web_t -l s0:c100,c100 firefox
> 2. step:
> sandbox -H homedir -T tempdir -t sandbox_web_t -l s0:c100,c100 firefox
> -remote "openurl(http://www.mozilla.org)"
> My current attempts fail because I'm unable use the '-l' option
> (#632377) but would the policy allow the 'firefox -remote' command if
> type and security level matches with the already running sandbox?
For the record:
Josh posted a while ago a simple method for opening a new tab in an
PS: nice to see someone else using ones submission (-w) :)
selinux mailing list
I am trying to come up with a way to make this easier. Maybe allow an
admin to specify a name of a sandbox, That would listen for connections.
There is a command seremote in the ~/ of each sandbox.
Then an external application can can seremote to have it connect to the
local Xserver, governed by SELinux. This could be used for launching
other tabs. Or other apps. I guess a better solution would be to
change seremote to also launch the app with the correct label.
Maybe this should look like
DISPLAY=:2 rucon SANDBOXCONTEXT -- "$@"
The ultimate solution would be to get it to use seunshare also so the
launched app would run in the same environment that the sandbox is in.
Then we could enhance sandbox so you could have multiple sessions
running and a controlling app could launch applications within any of
I am fooling around with gui app that might be useful here.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
-----END PGP SIGNATURE-----