How can private-tmp co-exist with dbus-filter user?

[crocket]

I run programs in different network namespaces where abstract dbus socket doesn't exist.

dbus sockets reside in /tmp. Thus, private-tmp breaks dbus usage.

Can I make dbus sockets in /tmp available with private-tmp?

[rusty-snake]

Can I make [foobar] in /tmp available with private-tmp?

Yes, private-tmp is at the end nothing else than a few whitelist /tmp/…. Therefore you can just whitelist /tmp/foobar.

[crocket]

That means parsing $DBUS_SESSION_BUS_ADDRESS in a script that launches firejail because the path to dbus socket is encoded in $DBUS_SESSION_BUS_ADDRESS.

$ echo $DBUS_SESSION_BUS_ADDRESS
unix:path=/tmp/dbus-2hrvYPvmIW,guid=1bec6c1a5f36912fc4424b0a61a9826d;unix:abstract=/tmp/dbus-gX42fGGlbH,guid=de98a1de4000cdc6e9716c7061a9826d

[rusty-snake]

In case your socket name has a random part whitelist /tmp/dbus-*.

[crocket]

Oh, that's it.

[kmk3]

Did you specifically choose /tmp/dbus- or is that a standard/common path?

If it's the latter, we could put it on disable-common.inc, etc.

[crocket]

The default listen address for dbus is unix:tmpdir=/tmp which tries to first create an abstract socket with the path as /tmp/dbus-*. If there is no support for abstract socket, it creates /tmp/dbus-*. Abstract unix sockets exist only on linux.

https://dbus.freedesktop.org/doc/dbus-specification.html contains details about tmpdir.

I manually added /etc/dbus-1/session.d/listen.conf

<!DOCTYPE busconfig PUBLIC "-//freedesktop//DTD D-Bus Bus Configuration 1.0//EN"
 "http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd">
<busconfig>
  <listen>unix:dir=/tmp</listen>
</busconfig>

I wish there was a way to disable abstract unix sockets in linux.