ladybird/Services/ImageDecoder
Andreas Kling c66c3b291a ImageDecoder: Restrict sandboxed clone syscalls
Only allow raw clone when the flags match pthread-style thread creation,
and return ENOSYS for clone3 so libc falls back to clone without giving
the sandbox an opaque process-creation syscall.

Drop the 32-bit audit architecture cases from the Linux sandbox while
here, since Ladybird does not support 32-bit systems and those paths
would need extra syscall variants.
2026-06-09 19:35:09 +02:00
..
CMakeLists.txt ImageDecoder: Sandbox the process on Linux 2026-06-09 19:35:09 +02:00
ConnectionFromClient.cpp ImageDecoder: Decode images on ThreadPool 2026-06-05 20:00:12 +02:00
ConnectionFromClient.h ImageDecoder: Decode images on ThreadPool 2026-06-05 20:00:12 +02:00
Forward.h Everywhere: Hoist the Services folder to the top-level 2024-11-10 12:50:45 +01:00
ImageDecoderClient.ipc LibImageDecoderClient: Remove sync id fetch from async decode request 2026-02-28 00:04:06 -06:00
ImageDecoderServer.ipc LibIPC+LibWeb+LibWebView+Services: Add IPC::TransportHandle 2026-03-12 20:32:55 +01:00
main.cpp ImageDecoder: Sandbox the process on Linux 2026-06-09 19:35:09 +02:00
Sandbox.h ImageDecoder: Sandbox the process on Linux 2026-06-09 19:35:09 +02:00
SandboxLinux.cpp ImageDecoder: Restrict sandboxed clone syscalls 2026-06-09 19:35:09 +02:00
SandboxUnimplemented.cpp ImageDecoder: Sandbox the process on Linux 2026-06-09 19:35:09 +02:00