Skip to content

Sandbox all the WebKit!

Description

Improve security of GNOME applications that render web content by doing so in a bubblewrap sandbox.

Goals

Every application using WebKitGTK should opt-in to the web process sandbox by calling webkit_web_context_set_sandbox_enabled(). See this blog post for context.

Scope

Everything that uses WebKitGTK

People on charge & contact

Michael Catanzaro (@mcatanzaro)

Instructions to achieve the goals

https://gitlab.gnome.org/GNOME/Initiatives/-/wikis/Sandbox-all-the-WebKit!

Label for tracking the initiative

Initiative: Sandbox all the WebKit!

Text for the initiative issue in projects

Every application using WebKitGTK should opt-in to the web process sandbox by calling webkit_web_context_set_sandbox_enabled(). See #19 for details.

List of projects & tasks

GNOME

World

  • bijiben
  • evolution, reverted awaiting printing
  • geary (waiting for printing)
  • glade
  • gnome-documents (archived)
  • libgepub

How can I help

Submit merge requests. It's easy!

If you see any GNOME software included in gnome-build-meta that uses WebKit but is not listed here, it is missing a dependency in gnome-build-meta. Please report it.

Edited by Michael Catanzaro
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information