clipboard permission of 'true' or 'false' is not granular enough

[lestephane]

I'm assuming that the way X11 works, there was no way to split the clipboard permission into read and write permissions.

But on the off change that there is a way, could this be improved by either supporting additional keys:

• clipboard-read
• clipboard-write

or by having the existing clipboard key support additional values

• read, write, read-write
• r, w, rw

If that is not possible due to X11, then disregard / close this issue. But if it is, it would be a great addition. This is my main use case for sandboxing (ie preventing the sandboxed app from reading the clipboard, but still being able to write to it).

[timthelion]

I think this should be a very easy addition. Just add the new config granularity and set the direction of the clipboard in the xpra bridge https://github.com/Xpra-org/xpra/blob/master/docs/Features/Clipboard.md#configuration-options should be like 6 linesof code. If you need pointers I'd be glad to help, but don't have time to code it up myself.

[timthelion]

You'll want to look at the following locations in the code:

1. Update the docs and add an OrderedDict type to the clipboard permission and add a sub-permission for the clipboard direction.

2. Set the clipboard direction flag: https://github.com/subuser-security/subuser/blob/master/subuserlib/classes/subuserSubmodules/run/x11Bridge.py#L219

3. Test

4. Create a pull request

5. Profit?

[timthelion]

Also see the developer documentation on adding permissions: https://subuser.org/developers/common-tasks.html#adding-a-new-permission