bug#40837: core-updates: webkitgtk web process sandbox incomplete

[Jack Hill]

On Wed, 6 May 2020, Marius Bakke wrote:

> Hello Jack,
>
> Thanks a lot for this work.

You're welcome. I'm happy that we seem to be making good progress.

> Jack Hill <address@hidden> writes:
>
> > Some additional observations:
> >
> > With my patched webkitgtk, if I set:
> >
> > PULSE_CLIENTCONFIG=/gnu/store/zc4dsmvdabi00nvisrjhi9w00ff4igs7-client.conf
> >
> > it does work, which is an improvement compared to without the patch.
>
> Great.  I have attached a patch for Guix that stops using /etc for these
> variables.

Good idea! That way we won't have to wait for WebKitGTK to canonicalize 
all paths :)

> > [0] 
> > https://github.com/NixOS/nixpkgs/blob/465566948393cf533e3617704d1c4ccc34cf3753/pkgs/development/libraries/webkitgtk/fix-bubblewrap-paths.patch
> >
> > so I wonder if I didn't do the mounts in the right place and or if it is
> > becasue I missed /run/current-system.
> >
> > I'm going to try to adapt the Nix patch to see if that helps.
>
> Were you able to verify whether /run/current-system is required inside
> the sandbox?

I don't think /run/current-system is needed.

> I cleaned up your patch a bit and rebased it on the latest master
> branch, available as patch 2/2 below.  Currently building it on
> 'core-updates' to verify that it works.  It takes a while on my dinky
> quad-core server though.  :-)
>
> It does not bind /run/current-system, and I think we should avoid it if
> possible.  Ideally we would only mount the store paths required by the
> consumers instead of all of /gnu/store, but not sure how to achieve
> that.

I've tested the updated patch by applying it to master and merging into 
core-updates. I'm happy to report that everything seems to be working for 
me after doing so!

Sharing less than the whole store sounds like a great aspiration, but I 
think we'd have to teach WebKitGTK how to ask Guix for its closure to do 
so. On FHS-compliant systems, all of the various /usr/lib and /usr/share 
directories are bind-mounted into the new namespace, so I don't think 
we're providing too much more. It's nice that our setuid binaries reside 
outside of the store :)

Best,
Jack