Failure of sandboxing
Failure of sandboxing
Posted Apr 18, 2025 10:11 UTC (Fri) by ebassi (subscriber, #54855)In reply to: Failure of sandboxing by epa
Parent article: Catanzaro: Dangerous arbitrary file read vulnerability in Yelp
> (I’d like to see a file open dialogue box that grants permission to a sandboxed app to open that file but no other; similarly for saving.)
That's literally the file chooser portal: https://flatpak.github.io/xdg-desktop-portal/docs/doc-org...
Which is what GTK, for instance, uses out of the box with its GtkFileDialog API: https://docs.gtk.org/gtk4/class.FileDialog.html
The file selection dialog runs on the host, and exposes only the user selected file(s) into the sandbox.