sandbox: open new firefox tab from outside

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 04/15/2011 09:08 AM, Christoph A. wrote:
> On 09/12/2010 02:54 PM, Christoph A. wrote:
>> Hi,
>>
>> I was using firefox within sandboxes for a while without perm. home
>> directory.
>> To store bookmarks, addons and so on, I started to use perm. homedir (-H).
>>
>> Because firefox does not allow multiple concurrent sessions (lock on
>> .mozilla) it is not possible to open multiple websites when specifying
>> the same sandbox homedir, hence I'm looking for a possibility to open
>> new websites within a running sandbox from outside.
>>
>> Without sandboxes everyone can open new websites in a running firefox
>> instance using:
>> firefox -remote "openurl(http://www.mozilla.org)"
>>
>> sandbox scenario:
>> 1. step:
>> start firefox:
>> sandbox -X -H homedir -T tempdir -t sandbox_web_t -l s0:c100,c100 firefox
>>
>> 2. step:
>> sandbox -H homedir -T tempdir -t sandbox_web_t -l s0:c100,c100 firefox
>> -remote "openurl(http://www.mozilla.org)"
>>
>> My current attempts fail because I'm unable use the '-l' option
>> (#632377) but would the policy allow the 'firefox -remote' command if
>> type and security level matches with the already running sandbox?
> 
> For the record:
> 
> Josh posted a while ago a simple method for opening a new tab in an
> existing sandbox:
> http://www.bress.net/blog/archives/195-Firefox-in-a-sandbox-with-Fedora.html
> 
> best regards,
> Christoph A.
> PS: nice to see someone else using ones submission (-w) :)
> 
> 
> 
> 
> 
> --
> selinux mailing list
> selinux at lists.fedoraproject.org
> https://admin.fedoraproject.org/mailman/listinfo/selinux

I am trying to come up with a way to make this easier.  Maybe allow an
admin to specify a name of a sandbox,  That would listen for connections.

There is a command seremote in the ~/ of each sandbox.

cat /tmp/.sandbox_home_DqoOT7/seremote
#!/bin/sh
DISPLAY=:2 "$@"

Then an external application can can seremote to  have it connect to the
local Xserver, governed by SELinux.  This could be used for launching
other tabs.  Or other apps.  I guess a better solution would be to
change seremote to also launch the app with the correct label.

Maybe this should look like

cat /tmp/.sandbox_home_DqoOT7/seremote
#!/bin/sh
DISPLAY=:2 rucon SANDBOXCONTEXT -- "$@"

The ultimate solution would be to get it to use seunshare also so the
launched app would run in the same environment that the sandbox is in.

Then we could enhance sandbox so you could have multiple sessions
running and a controlling app could launch applications within any of
the sandboxes.

I am fooling around with gui app that might be useful here.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAk2xZ3cACgkQrlYvE4MpobPrygCghbGKarh5dXdoocv2GgfjXbme
T6UAnAhvg2HVPIuZkI86OJREZ+yi2+Io
=FyFv
-----END PGP SIGNATURE-----