Firejail: Block access to dbus

[HulaHoopWhonix]

A very serious vulnerability was discovered where dbus-daemon used ipc message as format string. Subgraph's Oz sandbox say they are not affected since they block dbus access to isolated processes. I recommend you do the same if not already.

https://bugs.freedesktop.org/show_bug.cgi?id=98157

/cc @adrelanos

[chiraag-nataraj]

Easiest ways to do so:
1) Force DBus to use a standard UNIX socket (makes it easier to block) - see #801 for how to do so.
2) Only whitelist /tmp/_dbus-socket_ when necessary.

[netblue30]

In our case dbus can be disabled using a network namespace (--net) or AppAromr (--apparmor). It can also be disabled by configuring dbus to use a regular Unix socket instead of the abstract Unix socket, and blacklisting the socket inside the sandbox.

[intika]

i am blocking dbus access to chrome just by giving it a fake dbus address
env DBUS_SESSION_BUS_ADDRESS=none firejail chrome

[SkewedZeppelin]

@intika there is a dedicated nodbus option available in Firejail 0.9.54 and higher. It is more effective when combined with net none and if available apparmor.