Skip to content

Fix sandbox escape in GDBusServer

This implements https://gitlab.freedesktop.org/dbus/dbus/-/merge_requests/350 for GDBus's server implementation.

Abstract sockets belong to the network namespace instead of the mount namespace. As a result, mount namespace-based sandboxes (e.g. Flatpak) cannot restrict access to abstract sockets (and therefore GDBus's unix:tmpdir= server addresses) at least for applications with network access permission, which may result in sandbox escapes unless the application running the GDBus server explicitly check that the connecting process is not in a sandbox. As of the time of writing, no known applications using GDBusServer does this.

Fix this by always using non-abstract sockets for unix:tmpdir=, which is allowed by the DBus specification.

Edited by msizanoen1

Merge request reports