mirror of
https://github.com/jamesstringer90/appsandbox.git
synced 2026-10-22 11:03:15 -05:00
James Stringer
a2a3c0920a
- C10 appsandbox-clipboard.c: the host->guest INCR accumulator doubled accum_cap *before* realloc, so on realloc failure it memcpy'd into the un-enlarged buffer (heap overflow). Grow into a temp, commit the cap only on a successful realloc, and append only when the buffer has room. - L11 appsandbox-clipboard.c: reject FORMAT_LIST frames with data_size<4 before reading the 4-byte count (OOB read; Linux analog of H4/C9). - L18 appsandbox-clipboard.c: host->guest folder paste flattened — the text/uri-list builder listed every nested file and no directory, so the file manager pasted the files flat with no folder. List top-level items only (a top-level dir contributes its own URI; nested entries none), guarded on the dir actually existing. - L12 appsandbox-display.c: use-after-free reading p->plane_id after drmModeFreePlane(p) in cursor_init; log the cached cur->plane_id. - L13 appsandbox-audio.c: idle silence paced at 10ms < the ~21.3ms packet duration, overrunning the host render ring; pace at the true packet duration (FRAMES_PER_PACKET * 1000000000 / SAMPLE_RATE). Built in-VM and validated on a live Ubuntu VM (folder/sub-item paste; audio/display/clipboard daemons healthy after redeploy).
App Sandbox Linux guest daemons
In-VM Linux daemons that speak the same vsock wire protocol the Windows
App Sandbox host expects. See docs/linux-idd-implementation-plan.md in
the repo root for full architecture and wire-protocol reference.
Daemons (this directory)
| Binary | Channel | Listens on | Privilege | Status |
|---|---|---|---|---|
appsandbox-agent |
control | vsock :1 | root (system) | implemented |
appsandbox-input |
input | vsock :3 | root (system) | planned |
appsandbox-display |
frames + cursor | vsock :2 | root (system) | planned |
appsandbox-clipboard |
clipboard | vsock :5, :6 | user (user unit) | planned |
Build (inside the VM)
sudo apt-get install -y build-essential
make
Install + enable (inside the VM)
sudo make enable
This installs to /usr/local/bin/, drops the systemd unit into
/etc/systemd/system/, runs daemon-reload, then
systemctl enable --now appsandbox-agent.service.
Smoke test
systemctl status appsandbox-agent
journalctl -u appsandbox-agent -f
You should see listening on AF_VSOCK port 1. Once the host-side Phase 1
service-GUID switch lands, the App Sandbox UI's agent dot will turn green
within a few seconds of the unit being active.
Uninstall
sudo make disable
sudo rm /usr/local/bin/appsandbox-agent /etc/systemd/system/appsandbox-agent.service
sudo systemctl daemon-reload