Skip to main content

Sandboxing Skype

I am in the unfortunate position to have read Silver Needle in the Skype up to PDF page 21, where a successful heap overflow attack makes skype drop to a shell. Since then I decided that I either have to stop using Skype or sandbox it. Since about a year I have been doing the latter, with some bumps in the road, as new versions of Skype needed more files and more sandboxing. However, it worked for me most of the time, and it is time to share the gory details with the world.

The sandbox script can be found at http://gist.github.com/615366, where you can also edit the script.You need to have PulseAudio server running and listening to TCP traffic so that sound can break out of the sandbox. Verify that you have:

load-module module-native-protocol-tcp
in your PulseAudio config. Please review the variable settings to ensure that it fits your setup (DIR,XAUTHORITY,PULSECOOKIE). The sandbox is created for the user invoking the script. This user must have sudo capabilities to call the script. Please note that I have not reviewed the script with respect to security, so do not supply it to untrusted users.

Happy sandboxing. (Thanks to geheimdienst@#haskell-blah for pointing me to gist.github.com)

Comments

Popular posts from this blog

Liskell standalone

Some time has passed since I last blogged about Liskell. It is not dead nor have I changed my mind that Haskell needs a proper meta-programming facility not to mention a better syntax.Liskell was a branch of GHC once. Now it sits on top of the GHC API, or I should rather say sneaks behind its back as it creates its own API as the original one is not suitable for the stunts I'm interested in. If Liskell sticks with GHC as its soil, I will definitely send patches upstream to refine the GHC API in the areas where it needs more flexibility for Liskell. However for the moment, my main target was to get something out that compiles with a stable version of GHC.You can grab it with the usual: darcs get http://code.haskell.org/liskell/ This version has been tested with ghc 6.10.1 and should install like: ./Setup.lhs configure ./Setup.lhs build ./Setup.lhs install cd LskPrelude make install-inplace Optionally you can run make tests in the testsuite subdirectory. Thanks to community.haskell…

Is the new post-money SAFE mathematically sound?

Y-Combinator published a new set of documents for their SAFE, short for "Simple Agreement for Future Equity". The new version takes the document from a pre-money investment to a post-money investment. But for those of you that know neither versions, a SAFE is a legal document signed by the SAFE investor and a startup, so that the startup gets cash to build their product and the investor gets equity in the company. How much equity the SAFE investor gets is not spelled out in numbers but in the form of a set of equations that should compute this number at a later stage. "Later" usually means at the next funding round called Series A, where a larger investor injects more cash into an already working prototype of the product. At the point of Series A, it is much more clear on how the product performs and whether there is a market. The Series A investment usually happens a year after the SAFE investment. The assumption here is that it is fair to both the startup and th…

XMonad GridSelect

Personally, I not just need a window manager, I need a focus manager. I tend to think of windows as TODO items, and as there are many TODOs in life there are many windows on my workspaces. Usually a fraction of that can't be closed or worked on immediately, so they linger around on my desktop, cluttering my workspace.I used to use the Tabbed layout. But Tabbed isn't the answer when you are a guy who reports bugs such as "XMonad 0.6 with Tabbed dies when firefox-session-restore slams 40 windows at once on the desktop". In other words, I use a lot of windows. The workspaces concept isn't particularly useful to me either. My mind just doesn't work with mental boxes. So the result is, that I have too few workspaces with too much windows on them, so that Tabbed has trouble displaying useful window titles, and navigating through them is slow and cumbersome (mostly because tab switching generates a lot of useless X Expose events).GridSelect is my answer to that. It…