search

subuser-security / subuser

Run programs on linux with selectively restricted permissions.
http://subuser.org
GNU Lesser General Public License v3.0
889 stars 65 forks source link

tilda expansion doesn't seem to work #280

Closed ag4ve closed 7 years ago

ag4ve commented 8 years ago

subuser subuser add-to-path vim vim ~/.config/i3/config

opens up a blank buffer. :e doesn't change anything. Obviously doing: vim file or vim /home/me/.config/i3/config works just as it should

pretty stock fedora 23

timthelion commented 8 years ago

Well, tilda is expanded by bash so I don't think subuser actually sees any difference between vim ~/.config/i3/config and vim /home/me/.config/i3/config. But in the case of subuser, both commands should fail, because the vim subuser should be running in a container and that container should not contain the file /home/me/.config/i3/config. It is possible that you ended up creating a /home/me/.config/i3/config file in the container at some point between trying the tilda and the absolute path.

In general, however, both should fail. subusers just cannot access arbitrary files on your sysem. Subuser's like vim, which have the "access-working-directory" permission, can, however, access files in the directory from which they are launched. So if you pass vim, a relative path, that will work.

ag4ve commented 8 years ago

You might be right. That's kinda kludgy though. I'm thinking it might make things a bit better to pass the file using vim's netbeans interface (which could also be used to support other features like --servername and netrw). Though, I'm not quite sure how to maintain security while doing this. I'll give it a shot though (unless someone beats me to it).

timthelion commented 7 years ago

Closing this, while the usability issue is still present but I am well aware of the issue and this confusingly named issue is confusing me.