Join GitHub today
GitHub is home to over 28 million developers working together to host and review code, manage projects, and build software together.
Sign upSandbox tinyproxy #3800
Comments
andrewdavidwong
added
enhancement
C: other
security
labels
Apr 8, 2018
andrewdavidwong
added this to the Release 4.1 milestone
Apr 8, 2018
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
DemiMarie commentedApr 8, 2018
Qubes OS version:
R4.0
Affected component(s):
Tinyproxy and its various uses throughout Qubes
Steps to reproduce the behavior:
Analyze how tinyproxy is started
Expected behavior:
Tinyproxy should run in a tightly confined sandbox, enforced with seccomp-bpf, a chroot and/or namespaces, and more. The playpen tool (either https://github.com/thestinger/playpen, or my more recent fork at https://github.com/DemiMarie/playpen) can provide some examples for how to do that, or systemd’s built-in support can be used.
Actual behavior:
Tinyproxy runs unsandboxed, or as an unprivileged user but not otherwise sandboxed.
General notes:
Systemd can do most of this. We can also blacklist (using iptables or (better) nftables rules) the tinyproxy user
Related issues: