How to allow `systemd-run`

[finnvyrn]

$ fence  systemd-run --user flutter run -d Linux
Failed to connect to user scope bus via local transport: No such file or directory

[dwt]

@finnvyrn What are you trying to achieve? Allowing systemd-run to work, seems like a guaranteed sandbox escape as it will run code in the context of systemd - i.e. outside the sandbox?

[finnvyrn]

My workflow is to ask the agent to use system-run to launch flutter app and use a journalctl -f to watch for errors and send them to the agent, forming a closed autonomous loop. Using systemd-run also allows preventing multiple running instances. The agent can also use journalctl --since 3 munties ago for easier query.

[dwt]

That makes sense - but what about the sandbox escape?

[finnvyrn]

Actually I have been able to run it via --machine ¢USER@.host

[dwt]

That means that the user socket is probably writeable by the sandbox - which is probably also a sandbox escape.

@jy-tan Do you happen to know how we can close that loophole by default?

[laur89]

Doesn't this imply /run/user/1000/systemd directory is bound to the sandbox? But it's not by default, leaving me to assume OP is explicitly allowing for it?