GNU bug report logs - #47628
webkitgtk-2.32.0 fails to launch without /usr/bin

Previous Next

Full log

Message #41 received at 47628-done <at> debbugs.gnu.org (full text, mbox):

From: Maxim Cournoyer <maxim.cournoyer <at> gmail.com>
To: Mark H Weaver <mhw <at> netris.org>
Cc: Guillaume Le Vaillant <glv <at> posteo.net>, 47628-done <at> debbugs.gnu.org,
 Efraim Flashner <efraim <at> flashner.co.il>
Subject: Re: bug#47628: webkitgtk-2.32.0 fails to launch without /usr/bin
Date: Thu, 17 Mar 2022 22:47:10 -0400

Hi Mark,

Mark H Weaver <mhw <at> netris.org> writes:

> Hi Efraim,
>
> Efraim Flashner <efraim <at> flashner.co.il> writes:
>
>> On Thu, Apr 08, 2021 at 11:07:31AM -0400, Mark H Weaver wrote:
>>> I suspect that the relevant bit that needs to be changed is line 779 of
>>> the following file in the webkitgtk-2.32.0 source code:
>>> 
>>>   Source/WebKit/UIProcess/Launcher/glib/BubblewrapLauncher.cpp
>>> 
>>> Most likely, that line can simply be deleted.  Here's the relevant
>>> excerpt, with line 779 marked by "==>":
>>
>> Looking at the other lines above it, we could just change it from
>> ro-bind to ro-bind-try.
>
> I expect that would work, but why should we give the sandbox access to
> /usr/bin at all?  I took a different approach: I removed access to *all*
> of the FHS directories, since they should not be needed for a
> Guix-compiled package.
>
> Below, I've attached the patch that I'm currently using successfully on
> my private branch of Guix.
>
> What do you think?

Our webkitgtk package is patched in such a way (and more) since commit
b9a4705f80e89fff3b65288cbbe8df73a365aee3.

Thanks, 

Maxim

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.