valpackett/capsicumizer

Run anything (like full blown GTK apps) under Capsicum

The Super Capsicumizer 9000

capsicumizer is a sandbox launcher that imposes Capsicum capability mode onto an unsuspecting program, allowing "sysadmin style" or "oblivious" sandboxing (i.e. no source code modifications, all restrictions added externally).

You just write AppArmor-esque "profiles" and capsicumizer takes care of sandboxing the applications.

capsicumizer is capable of launching some GUI applications (like gedit) on both Wayland and X11.

(GTK 3.24 required because of this patch)

Note: applications that use syscalls directly (instead of going through libc) — namely, anything compiled with Golang's official compiler — won't be able to actually access files under the allowed paths. This is because we rely on LD_PRELOADing a library (libpreopen) that overrides libc functions like open to make them use openat style functions with pre-opened directory descriptors.

Requirements

• a recent version of FreeBSD
• Meson build system
• libucl >=0.8.1 (pkg: #233383)
• libpreopen (that linked fork, at least for now) (pkg: someday)

Usage

Capsicumizer profiles are written in UCL syntax (which is pretty common on FreeBSD), and can be used as directly runnable scripts (#!):

#!/usr/bin/env capsicumizer

run = "/usr/local/bin/gedit";

access_path = [
	"$HOME",
	"/usr/local",
	"/var/db/fontconfig",
	"/tmp",
];

library_path = [
	"/lib",
	"/usr/lib",
	"/usr/local/lib",
	"/usr/local/lib/gvfs",
	"/usr/local/lib/gio/modules",
	"/usr/local/lib/gedit",
];

# gedit does not need any extra preloads
# this is just an example
ld_preload = [
	"libgobject-2.0.so"
];

Environment variables and program arguments ($0 etc.) are exposed as UCL variables.

Contributing

By participating in this project you agree to follow the Contributor Code of Conduct.

The list of contributors is available on GitHub.

License

This is free and unencumbered software released into the public domain.
For more information, please refer to the UNLICENSE file or unlicense.org.

capsicumizer's Issues

Add the ability to prepend/append command args from the script

Browser?

This looks really cool. Could this work for say firefox or surf? Or wouldn't capsicum deny new sockets?

Does it prevent anything like keyboard capture or screen watching with X? I imagine not.

I guess if network access is limited, then X capture doesn't matter unless say a hacked application spun up a terminal and typed out some netcat command to send screenshots or the like.

Have to preopen /home instead of /home/user for all the home related stuff to work GTK

FreeBSD port

Hi,

will this program be part of the FreeBSD portstree?

Or do you know similar programs that are already part of the portstree.

Kind regards,
abelbabel