-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 04/15/2011 09:08 AM, Christoph A. wrote: > On 09/12/2010 02:54 PM, Christoph A. wrote: >> Hi, >> >> I was using firefox within sandboxes for a while without perm. home >> directory. >> To store bookmarks, addons and so on, I started to use perm. homedir (-H). >> >> Because firefox does not allow multiple concurrent sessions (lock on >> .mozilla) it is not possible to open multiple websites when specifying >> the same sandbox homedir, hence I'm looking for a possibility to open >> new websites within a running sandbox from outside. >> >> Without sandboxes everyone can open new websites in a running firefox >> instance using: >> firefox -remote "openurl(http://www.mozilla.org)" >> >> sandbox scenario: >> 1. step: >> start firefox: >> sandbox -X -H homedir -T tempdir -t sandbox_web_t -l s0:c100,c100 firefox >> >> 2. step: >> sandbox -H homedir -T tempdir -t sandbox_web_t -l s0:c100,c100 firefox >> -remote "openurl(http://www.mozilla.org)" >> >> My current attempts fail because I'm unable use the '-l' option >> (#632377) but would the policy allow the 'firefox -remote' command if >> type and security level matches with the already running sandbox? > > For the record: > > Josh posted a while ago a simple method for opening a new tab in an > existing sandbox: > http://www.bress.net/blog/archives/195-Firefox-in-a-sandbox-with-Fedora.html > > best regards, > Christoph A. > PS: nice to see someone else using ones submission (-w) :) > > > > > > -- > selinux mailing list > selinux@xxxxxxxxxxxxxxxxxxxxxxx > https://admin.fedoraproject.org/mailman/listinfo/selinux I am trying to come up with a way to make this easier. Maybe allow an admin to specify a name of a sandbox, That would listen for connections. There is a command seremote in the ~/ of each sandbox. cat /tmp/.sandbox_home_DqoOT7/seremote #!/bin/sh DISPLAY=:2 "$@" Then an external application can can seremote to have it connect to the local Xserver, governed by SELinux. This could be used for launching other tabs. Or other apps. I guess a better solution would be to change seremote to also launch the app with the correct label. Maybe this should look like cat /tmp/.sandbox_home_DqoOT7/seremote #!/bin/sh DISPLAY=:2 rucon SANDBOXCONTEXT -- "$@" The ultimate solution would be to get it to use seunshare also so the launched app would run in the same environment that the sandbox is in. Then we could enhance sandbox so you could have multiple sessions running and a controlling app could launch applications within any of the sandboxes. I am fooling around with gui app that might be useful here. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAk2xZ3cACgkQrlYvE4MpobPrygCghbGKarh5dXdoocv2GgfjXbme T6UAnAhvg2HVPIuZkI86OJREZ+yi2+Io =FyFv -----END PGP SIGNATURE----- -- selinux mailing list selinux@xxxxxxxxxxxxxxxxxxxxxxx https://admin.fedoraproject.org/mailman/listinfo/selinux
