Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

profiles: blacklist sway IPC socket #6429

Merged
merged 1 commit into from
Aug 7, 2024
Merged

Conversation

FelixPehla
Copy link
Contributor

Much like the i3 IPC socket (#6361), the sway IPC socket also allows arbitrary code execution via the exec subcommand (i.e. swaymsg exec 'echo test > ~/test') . Access should only be permitted to sway itself by default.

The location of the IPC socket is set in sway/ipc-server.c:

	const char *dir = getenv("XDG_RUNTIME_DIR");
	if (!dir) {
		dir = "/tmp";
	}
	if (path_size <= snprintf(ipc_sockaddr->sun_path, path_size,
			"%s/sway-ipc.%u.%i.sock", dir, getuid(), getpid())) {
		sway_abort("Socket path won't fit into ipc_sockaddr->sun_path");
	}

@FelixPehla
Copy link
Contributor Author

FelixPehla commented Aug 1, 2024

Realized that I used slightly different paths (${RUNUSER}/sway-ipc.* vs. ${RUNUSER}/sway-ipc.*.sock) in different files, should be consistent now.

Copy link
Collaborator

@glitsj16 glitsj16 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice to have this in.

Much like the i3 IPC socket (netblue30#6361), the sway IPC socket also allows
arbitrary code execution via the `exec` subcommand. Access should only
be permitted to sway itself by default.

The location of the IPC socket is set in sway/ipc-server.c:

https://github.com/swaywm/sway/blob/7e74a4914261cf32c45017521960adf7ff6dac8f/sway/ipc-server.c#L126
Copy link
Collaborator

@kmk3 kmk3 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nicely done.

@glitsj16 glitsj16 merged commit de85522 into netblue30:master Aug 7, 2024
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants