sandbox

Documentation

Overview

Package sandbox handles launching applications in a sandboxed enviornment via bubblwrap.

Index

• func IsGrsecKernel() bool
• func RunTor(cfg *config.Config, manif *config.Manifest, torrc []byte) (process *Process, err error)
• func RunTorBrowser(cfg *config.Config, manif *config.Manifest, tor *tor.Tor) (process *Process, err error)
• func RunUpdate(cfg *config.Config, mar []byte) (err error)
• func SetSensibleRlimits() error

Functions

func IsGrsecKernel

func IsGrsecKernel() bool

IsGrsecKernel returns true if the system appears to be running a grsec kernel.

func RunTor

func RunTor(cfg *config.Config, manif *config.Manifest, torrc []byte) (process *Process, err error)

RunTor launches sandboxeed Tor.

func RunTorBrowser

func RunTorBrowser(cfg *config.Config, manif *config.Manifest, tor *tor.Tor) (process *Process, err error)

RunTorBrowser launches sandboxed Tor Browser.

func RunUpdate

func RunUpdate(cfg *config.Config, mar []byte) (err error)

RunUpdate launches sandboxed Tor Browser update.

func SetSensibleRlimits

func SetSensibleRlimits() error

SetSensibleRlimits conservatively lowers the rlimits to values that will happily support firefox, the updater, tor, and obfs4proxy.

XXX; In the future, this should be applied to each process individually. I still need to think about what I'll do for the things that are unset, because it should be tied into the UI.