Subject: bug#45198: 28.0.50; Sandbox mode

From: Mattias Engdegård <[email-masked]>
Date: Sun, 13 Dec 2020 16:31:00 +0100

> I'm still worried that there remain wide open security holes, tho.

Yes, and we need defence in depth. In addition to the measures already taken in the patch:

1. Add crash_if_sandboxed() calls in low-level routines that do objectionable things such as opening files for writing, create network connections, spawn processes, do DNS lookups, etc.

2. Platform-specific restrictions. I'll add macOS sandboxing if nobody else does. For Linux there are several options, most a bit messy but possible to use: seccomp (with or without BFP), name spaces, ptrace, etc.