System-wide sandboxing framework - sandbox-app-launcher

Development
,
325

Indeed. User would have to re-run setup, which is bad usability. Would be better if we could fix that automagically for the user.

In theory, yes. But during run_program() sandbox-app-launcher is run as user, not root. Therefore I don’t see how that’s possible. If a have a solution, please implement or let me know.

I have one idea that would be doable, though.

At the moment the tests during setup() look like this:

  if ! [ "$(stat -c %a "${shared_dir}")" = "1777" ]; then
    chmod 1777 "${dir}"
  fi

I.e.

  1. Test if already done.
  2. Do whatever needed not already done.

What could be done when running as user, without root, during run_program() is instead:

  1. Test if already done.
  2. If root, do it if not yet done. | If user, notify user and error exit.
run_if_root() {
  if [ "$sal_is_run_with_root" = "true" ]; then
    "$@"
  else
    echo "ERROR: The setup for this program is incomplete. To fix, please execute:

sudo sandbox-app-launcher setup ${app_name}

(Debugging information: $@)" >&2
    exit 1
  fi
}

if [ "$(id -u)" = "0" ]; then
  sal_is_run_with_root=true
fi

if ! [ "$(stat -c %a "${shared_dir}")" = "1777" ]; then
  run_if_root chmod 1777 "${dir}"
fi

What do you think?

1 Like