<html>
<head>
<base href="https://bugs.webkit.org/" />
</head>
<body>
<p>
<div>
<b><a class="bz_bug_link
bz_status_NEW "
title="NEW - [Seccomp] Web process has too much access to /run/user"
href="https://bugs.webkit.org/show_bug.cgi?id=143004#c3">Comment # 3</a>
on <a class="bz_bug_link
bz_status_NEW "
title="NEW - [Seccomp] Web process has too much access to /run/user"
href="https://bugs.webkit.org/show_bug.cgi?id=143004">bug 143004</a>
from <span class="vcard"><a class="email" href="mailto:mcatanzaro@igalia.com" title="Michael Catanzaro <mcatanzaro@igalia.com>"> <span class="fn">Michael Catanzaro</span></a>
</span></b>
<pre>Talked with AP. Indeed, the at-spi2 socket is a total sandbox escape: it can be used to inspect the accessibility tree of arbitrary applications, send them keyboard input, etc. We can't allow access to it. Also we can't block it, since that breaks a11y. A design change will be required. It should be considered in tandem with the problem of supporting a11y under Wayland.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>