Sandboxing Skype

I am in the unfortunate position to have read Silver Needle in the Skype up to PDF page 21, where a successful heap overflow attack makes skype drop to a shell. Since then I decided that I either have to stop using Skype or sandbox it. Since about a year I have been doing the latter, with some bumps in the road, as new versions of Skype needed more files and more sandboxing. However, it worked for me most of the time, and it is time to share the gory details with the world.

The sandbox script can be found at http://gist.github.com/615366, where you can also edit the script.

You need to have PulseAudio server running and listening to TCP traffic so that sound can break out of the sandbox. Verify that you have

load-module module-native-protocol-tcp

in your PulseAudio config. Please review the variable settings to ensure that it fits your setup (DIR,XAUTHORITY,PULSECOOKIE). The sandbox is created for the user invoking the script. This user must have sudo capabilities to call the script. Please note that I have not reviewed the script with respect to security, so do not supply it to untrusted users.

Happy sandboxing.

(Thanks to geheimdienst@#haskell-blah for pointing me to gist.github.com)