From 85a8cc99baf244a164b4819f6784ffdea313130b Mon Sep 17 00:00:00 2001 From: ed Date: Thu, 9 Jul 2026 18:56:25 +0000 Subject: [PATCH] bwrap: default-disable; many distros dont care about FHS, so th-bwrap cannot be autoconfigured --- README.md | 3 +++ copyparty/__main__.py | 4 ++-- scripts/docker/innvikler.sh | 1 - 3 files changed, 5 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index ea9d29bd..9ae91b68 100644 --- a/README.md +++ b/README.md @@ -3036,6 +3036,9 @@ some notes on hardening * the `nohtml` volflag also enables `noscript` which, on its own, prevents *most* javascript from running; enabling just `noscript` without `nohtml` makes it probably-safe (see below) to view html and svg files, but `nohtml` is necessary to block javascript in markdown documents * "probably-safe" because it relies on `Content-Security-Policy` so it depends on the reverseproxy to forward it, and the browser to understand it, but `nohtml` (the nuclear option) always works * when running behind a reverse-proxy, listen on a unix-socket for tighter access control (and more performance); see [reverse-proxy](#reverse-proxy) or [`--help-bind`](https://copyparty.eu/cli/#bind-help-page) +* put ffmpeg into a sandbox (helps against future ffmpeg vulns) by configuring [--th-bwrap](https://copyparty.eu/cli/#g-th-bwrap) and enable it with `--use-bwrap y` + * usually impossible when running in docker or podman + * the default value of `--th-bwrap` (see `--help` on your own server) is autogenerated best-effort guess based on your setup; installing `bwrap` and configuring this is up to you (good luck) safety profiles: diff --git a/copyparty/__main__.py b/copyparty/__main__.py index d6669b19..8e837cc4 100644 --- a/copyparty/__main__.py +++ b/copyparty/__main__.py @@ -1713,9 +1713,9 @@ def add_safety(ap): ap2.add_argument("--acam", metavar="V[,V]", type=u, default="GET,HEAD", help="Access-Control-Allow-Methods; list of methods to accept from offsite ('*' behaves like \033[33m--acao\033[0m's description)") if FULL_HELP or (not ANYWIN and not UNIX): ap2.add_argument("--th-bwrap", metavar="CMD", type=u, default=th_bwrap, help="optional bwrap sandbox command for FFmpeg and dcraw (Linux-only)") - ap2.add_argument("--use-bwrap", metavar="C", type=u, default="a", help="a/n/f; [\033[32ma\033[0m]=auto (yes if the program 'bwrap' exists (assumes it works)), [\033[32mn\033[0m]=no (assumes bwrap is broken), [\033[32mf\033[0m]=force (disables FFmpeg if bwrap unavailable)") + ap2.add_argument("--use-bwrap", metavar="TXT", type=u, default="n", help="a/n/f; [\033[32ma\033[0m]=auto (yes if the program 'bwrap' exists (assumes it works)), [\033[32mn\033[0m]=no (assumes bwrap is broken), [\033[32mf\033[0m]=force (disables FFmpeg if bwrap unavailable)") else: - ap2.add_argument("--use-bwrap", metavar="C", type=u, default="n", help=argparse.SUPPRESS) + ap2.add_argument("--use-bwrap", metavar="TXT", type=u, default="n", help=argparse.SUPPRESS) def add_salt(ap, fk_salt, dk_salt, ah_salt): diff --git a/scripts/docker/innvikler.sh b/scripts/docker/innvikler.sh index 54540bff..4495e740 100644 --- a/scripts/docker/innvikler.sh +++ b/scripts/docker/innvikler.sh @@ -48,7 +48,6 @@ cat >initcfg <<'EOF' [global] chdir: /w no-crt - use-bwrap: n % /cfg EOF