colin/bubblewrap
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

bwrap.xml: Mention CVE-2017-5226 with --new-session

Browse Source 
Signed-off-by: Sebastian Pipping <sebastian@pipping.org>
This commit is contained in:
Sebastian Pipping
2023-03-05 00:38:51 +01:00
committed by Alexander Larsson
parent 9b246d4297
commit 35e6b2a698
1 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
bwrap.xml
View File

@@ -464,7 +464,9 @@
</para><para>
Note: In a general sandbox, if you don't use --new-session, it is
recommended to use seccomp to disallow the TIOCSTI ioctl, otherwise
the application can feed keyboard input to the terminal.
the application can feed keyboard input to the terminal
which can e.g. lead to out-of-sandbox command execution
(see CVE-2017-5226).
</para></listitem>
</varlistentry>
<varlistentry>