Media plugins: run SLPlugin in a sandbox (Linux and Windows) #910

New issue

Open

opened 2026-10-21 03:30:44 +00:00 by sky_line · 0 comments

sky_line commented

2026-10-21 03:30:44 +00:00

Owner

Feature

Run media plugin processes (GStreamer, libVLC, CEF host) with least privilege, so a bug in a media decoder can't reach the user's files or the rest of the system.

Scope

Linux: seccomp-bpf syscall filter plus user/mount namespaces or Landlock. No access to the home directory beyond the plugin's own cache, no access to the user's sessions (D-Bus, X11/Wayland sockets except what's needed), and network limited to what the stream needs.
Windows: restricted token or AppContainer, a low-integrity process, and a Job object (no child processes, UI and handle limits).
Shared-memory and IPC with the viewer keep working (the plugin pipe, shared texture and audio ring).
CEF has its own sandbox; check whether ours is enabled and compatible.
A setting to turn it off for troubleshooting, and clear logging when the sandbox blocks something.

Estimate

Linux 3–5 days, Windows 1–2 weeks.

## Feature Run media plugin processes (GStreamer, libVLC, CEF host) with least privilege, so a bug in a media decoder can't reach the user's files or the rest of the system. ## Scope - **Linux:** seccomp-bpf syscall filter plus user/mount namespaces or Landlock. No access to the home directory beyond the plugin's own cache, no access to the user's sessions (D-Bus, X11/Wayland sockets except what's needed), and network limited to what the stream needs. - **Windows:** restricted token or AppContainer, a low-integrity process, and a Job object (no child processes, UI and handle limits). - Shared-memory and IPC with the viewer keep working (the plugin pipe, shared texture and audio ring). - CEF has its own sandbox; check whether ours is enabled and compatible. - A setting to turn it off for troubleshooting, and clear logging when the sandbox blocks something. ## Estimate Linux 3–5 days, Windows 1–2 weeks.

sky_line added the

feature

priority

high

labels

2026-10-21 03:30:44 +00:00

sky_line added this to the Slipstream project

2026-10-21 03:30:44 +00:00