Skip to content
  • msizanoen1's avatar
    gio/gdbusserver: use non-abstract socket for unix:tmpdir= · c0a1a3b3
    msizanoen1 authored
    This implements https://gitlab.freedesktop.org/dbus/dbus/-/merge_requests/350
    for GDBus's server implementation.
    
    Abstract sockets belong to the network namespace instead of the mount
    namespace. As a result, mount namespace-based sandboxes (e.g. Flatpak)
    cannot restrict access to abstract sockets (and therefore GDBus's
    unix:tmpdir= server addresses), at least for applications with network
    access permission, which may result in sandbox escapes unless the
    application running the GDBus server explicitly check that the connecting
    process is not in a sandbox. As of the time of writing, no known
    applications using GDBusServer does this.
    
    Fix this by always using non-abstract sockets for unix:tmpdir=, which is
    allowed by the DBus specification.
    c0a1a3b3