143004 2015-03-24 07:53:38 -0700 [Seccomp] Web process has too much access to /run/user 2018-12-10 08:34:11 -0800 1 1 1 Unclassified WebKit WebKit2 528+ (Nightly build) PC Linux RESOLVED WONTFIX P2 Normal --- 1 mcatanzaro webkit-unassigned apinheiro jdiggs mcatanzaro mgorse zan oldest_to_newest 1079606 0 mcatanzaro 2015-03-24 07:53:38 -0700 We grant access to all of /run/user/1000/ (where 1000 is my UID), which is needed for at-spi2 since it puts folders with random-looking names. But there are sockets there for gnome-keyring, dconf, and gvfs that the web process really should not be able to touch. Possible solutions: * Support globs, so that we can more precisely whitelist /run/user/1000/at-spi2-* instead. * Even then, I imagine the web process can do bad things to other apps with that permission... can it be used to inspect or control other processes? It would be nicest if at-spi2 created a more predictable directory name so that we could limit the web process. 1079607 1 mcatanzaro 2015-03-24 07:59:31 -0700 Hey Joanie, I think you're the expert here. The security model is that the web process has been compromised and running attacker-controlled code, and is trying to access the user's personal files, so ideally it would not be able to have any more access in /run/user/uid than it really needs. I can just imagine it using the at-spi2 socket to control nautilus or something; is that possible? 1079609 2 jdiggs 2015-03-24 08:06:53 -0700 Adding Piñeiro. 1125973 3 mcatanzaro 2015-09-15 08:56:37 -0700 Talked with AP. Indeed, the at-spi2 socket is a total sandbox escape: it can be used to inspect the accessibility tree of arbitrary applications, send them keyboard input, etc. We can't allow access to it. Also we can't block it, since that breaks a11y. A design change will be required. It should be considered in tandem with the problem of supporting a11y under Wayland.