subgraph / gnome-shell-extension-ozshell

GNOME Shell extension for interfacing with the OZ application sandboxing framework

OZ Shell Gnome Extension

This is a Gnome Shell extension for interfacing with the OZ application sandboxing framework.

It allows viewing the running sandboxes, adding and removing user files into the sandboxes, terminating them, and opening a shell terminal inside the sandbox.

Demo

Installation

Prerequisites

You need to have gjs installed , so if it is not already:

apt-get install gjs

If you are running grsecurity/pax you will require to disable the mprotect pax flag on the gjs executable as with most JIT.

If you would like to get rid of this dependency you could write a small python, c, or golang program to replace the small Gtk filechooser in openFiles.js.

Building

Manually

If you do not wish to build it on your own you can simply download the lastest zip release and skip this step.

# Install the build dependencies:
sudo apt-get install libglib2.0-dev gnome-common
# Build it:
git clone https://github.com/subgraph/gnome-shell-extension-ozshell.git
cd gnome-shell-extension-ozshell
./autogen.sh
./configure --prefix=/usr
make
# To install for your user:
make local-install
# To install globally:
sudo make install
# To generate a distribution zip:
make zip

As a debian package

git clone -b debian https://github.com/subgraph/gnome-shell-extension-ozshell.git
cd gnome-shell-extension-ozshell
gbp buildpackage -us -uc
sudo dpkg -i ../build-area/gnome-shell-extension-ozshell_<version>_all.deb

Installing

You can now enable the applet: go into gnome-tweak-tool; you may require to reload gnome-shell first (<alt-f2> enter r and press <enter> or pkill -SIGHUP gnome-shell).

Formalities

Caveats

Currently the refresh is done by clearing the whole menu and rebuilding it. This is not only inefficient, but it means that the applet will not refresh if the menu is open. This should be fixed in the future by a) going through the items and individually removing/inserting them, b) the addition of push events (will require additional components to be added to oz-daemon).

Translation & Credits

• Deutsch: Stefanie Schirmer
• Thomas liebetraut for his build template
• Bakunin for the inspiration.
• Add your name here, send me a pull request!

gnome-shell-extension-ozshell's Issues

Allow adding entire directories

Right now only files can be added to the dynamic whitelist from the extension. It should be possible to add directories as well since this is the only way to actually exfiltrate files.

Migrate commands to async to avoid lock ups

There are some edge cases where the IPC to the oz-daemon fails or is slowed down and this can cause gnome-shell lock ups. The commands should be migrated to async mode to prevent this.

Root cause of subgraph/oz#48