Changeset 92e5300 for x

Timestamp:

08/09/2023 03:09:07 AM (14 months ago)

Author:

Douglas R. Reno <renodr@…>

Branches:

12.0, 12.1, 12.2, gimp3, ken/TL2024, ken/tuningfonts, lazarus, plabs/newcss, python3.11, rahul/power-profiles-daemon, renodr/vulkan-addition, trunk, xry111/for-12.3, xry111/llvm18, xry111/spidermonkey128

Children:

ea7abff3

Parents:

fb3323ad

Message:

Enable the Bubblewrap sandbox in WebKitGTK+.

This should help minimize the impact of some security vulnerabilities.

File:

• x/lib/webkitgtk.xml (modified) (9 diffs)

x/lib/webkitgtk.xml

@@ -108 +108 @@
     <bridgehead renderas="sect4">Recommended</bridgehead>
     <para role="recommended">
+      <xref linkend="bubblewrap"/>,
       <xref linkend="enchant"/>,
       <xref linkend="geoclue2"/>,
       <xref linkend="gobject-introspection"/>,
-      <xref linkend="hicolor-icon-theme"/>, and
-      <xref linkend="libavif"/>
+      <xref linkend="hicolor-icon-theme"/>,
+      <xref linkend="libavif"/>, and
+      <xref linkend="xdg-dbus-proxy"/>
     </para>
 
     <bridgehead renderas="sect4">Optional</bridgehead>
     <para role="optional">
-      <xref linkend="bubblewrap"/>,
+      <!--<xref linkend="bubblewrap"/>,-->
       <xref linkend="gi-docgen"/>,
       <xref linkend="harfbuzz"/>,
@@ -125 +127 @@
       <ulink url="https://sourceforge.net/projects/hunspell/files/Hyphen/">Hyphen</ulink>,
       <!--<ulink url="https://github.com/AOMediaCodec/libavif">libavif</ulink>,-->
-      <ulink url="https://github.com/libjxl/libjxl">libjxl</ulink>,
-      <ulink url="https://gnome.pages.gitlab.gnome.org/libmanette/">libmanette</ulink>, and
-      <ulink url="https://github.com/flatpak/xdg-dbus-proxy">xdg-dbus-proxy</ulink>
+      <ulink url="https://github.com/libjxl/libjxl">libjxl</ulink>, and
+      <ulink url="https://gnome.pages.gitlab.gnome.org/libmanette/">libmanette</ulink>
+      <!--<ulink url="https://github.com/flatpak/xdg-dbus-proxy">xdg-dbus-proxy</ulink>-->
     </para>
 
@@ -189 +191 @@
       -DUSE_WPE_RENDERER=ON       \
       -DUSE_JPEGXL=OFF            \
-      -DENABLE_BUBBLEWRAP_SANDBOX=OFF \
+      -DENABLE_BUBBLEWRAP_SANDBOX=ON \
       -Wno-dev -G Ninja ..        &amp;&amp;
 ninja</userinput></screen>
@@ -210 +212 @@
       -DUSE_WPE_RENDERER=ON       \
       -DENABLE_JOURNALD_LOG=OFF   \
-      -DENABLE_BUBBLEWRAP_SANDBOX=OFF \
+      -DENABLE_BUBBLEWRAP_SANDBOX=ON \
       -Wno-dev -G Ninja ..        &amp;&amp;
 ninja</userinput></screen>
@@ -220 +222 @@
       there is a problem with the build.
     </para>
-
-<!-- Since we're using Ninja now instead of autotools, this isn't valid anymore
-    <note><para>
-      When installing, the Makefile does some additional compiling and linking.
-      If you do not have Xorg in /usr, the LIBRARY_PATH and PKG_CONFIG_PATH
-      variables need to be defined for the root user.  If using sudo to assume
-      root, use the -E option to pass your current environment variables for the
-      install process.
-    </para></note>
--->
 
     <para>
@@ -273 +265 @@
       -DUSE_JPEGXL=OFF            \
       -DUSE_WPE_RENDERER=ON       \
-      -DENABLE_BUBBLEWRAP_SANDBOX=OFF \
+      -DENABLE_BUBBLEWRAP_SANDBOX=ON \
       -Wno-dev -G Ninja ..        &amp;&amp;
 ninja</userinput></screen>
@@ -293 +285 @@
       -DUSE_WPE_RENDERER=ON       \
       -DENABLE_JOURNALD_LOG=OFF   \
-      -DENABLE_BUBBLEWRAP_SANDBOX=OFF \
+      -DENABLE_BUBBLEWRAP_SANDBOX=ON \
       -Wno-dev -G Ninja ..        &amp;&amp;
 ninja</userinput></screen>
@@ -353 +345 @@
 
     <para>
-      <parameter>-DENABLE_BUBBLEWRAP_SANDBOX=OFF</parameter>: Remove this
-      switch if the optional packages <xref linkend="bubblewrap"/> and
-      <ulink url="https://github.com/flatpak/xdg-dbus-proxy">xdg-dbus-proxy</ulink>
-      are installed.
+      <parameter>-DENABLE_BUBBLEWRAP_SANDBOX=ON</parameter>: This switch
+      enables the Bubblewrap sandbox, which helps mitigate the impact of most
+      security vulnerabilities in this package. Change this switch to OFF if
+      you do not want to install <xref linkend="bubblewrap" role="nodep"/> and
+      <xref linkend="xdg-dbus-proxy" role="nodep"/>, but note that this may
+      put you at risk.
+      <!-- Note: This works well on both i686 and x86_64. -renodr -->
     </para>
 
@@ -386 +381 @@
       support for fonts.
     </para>
-
-    <!-- Uncomment once GTK4 support works, or when it doesn't require
-         a development version of libsoup.
-    <para>
-      <option>-DUSE_GTK4=ON</option>: Use this switch if <xref linkend="gtk4"/>
-      is installed and you wish to build GTK4 support.
-    </para>
-    -->
 
   </sect2>