Re: [atomic-devel] xdg-open-gateway

[Neal Gompa <ngompa13 gmail com>]

On Wed, Jun 20, 2018 at 8:55 AM Matthias Clasen <mclasen redhat com> wrote:
>
> On Wed, Jun 20, 2018 at 8:51 AM Neal Gompa <ngompa13 gmail com> wrote:
>>
>> On Wed, Jun 20, 2018 at 8:47 AM Matthias Clasen <mclasen redhat com> wrote:
>> >
>> > On Tue, Jun 19, 2018 at 11:04 AM Vladimir Panteleev <projectatomic thecybershadow net> wrote:
>> >>
>> >> Hello!
>> >>
>> >> A while ago, I was looking for a way to have bubblewrap'd programs open
>> >> files and URLs outside their container, and stumbled upon the Snap
>> >> project's snapd-xdg-open:
>> >>
>> >> https://github.com/snapcore/snapd-xdg-open
>> >>
>> >
>> > This looks very similar to https://github.com/flatpak/flatpak-xdg-utils, which still exists and provides
>> > the same functionality for flatpak, by talking to the OpenURI portal.
>> >
>>
>> The key difference is that the Flatpak one requires portal
>> integration, while xdg-open-gateway does not. Trivially
>> confined/sandboxed applications who attempt to access xdg-open are
>> correctly redirected to the host to trigger the OpenURI action.
>>
>
> Not sure what that means. Either it gives blanket access (then why have it ?) or it has to talk to some intermediary.
> If you call it a portal or not doesn't really matter that much. And I don't understand your point about conflicting with
> a script in the host /usr/bin at all - surely, that is not visible in the container ?

There are two binaries: one for the host (dbus-activated) and one for
the sandbox (bind mounted in to overload /usr/bin/xdg-open). For
sandbox setups that don't require all the overhead of flatpak (such as
manual bubblewrap setups, sbox[1], firejail stuff, etc.),
xdg-open-gateway works.

The issue with the portal stuff is that it requires applications at
some level to have the awareness to behave differently. That's
fundamentally problematic if the goal is to be able to sandbox
arbitrary applications. Usually, this is at the toolkit level, but it
doesn't have to be, and ultimately, something has to do it.

[1]: https://github.com/decathorpe/sbox

-- 
真実はいつも一つ！/ Always, there's only one truth!