~whynothugo/way-secure - Create wayland security contexts - sourcehut git
You can also use your local clone with git send-email.
way-secure needs to be provided with the socket where the compositor will listen to events. The parent process needs to create the socket, bind it and prepare it to accept connections by calling listen(2).
An optional file descriptor provided via --close-fd can control when the compositor ought to stop listening for new connections. If this flag is not provided, way-secure will remain in background, and the secure context will continue accepting connections until the way-secure processed is killed.
Using a secure-context is required to create a secure sandbox on a Wayland desktop, but not sufficient. A client can trivially just inspect $XDG_RUNTIME_DIR and find a fully privileged socket. This tool is intended to be used in concert with other sandboxing techniques.
