[sane-devel] Sandboxing scanner applications

[Till Kamppeter]

On 18/09/2020 18:49, Alexander Pevzner wrote:
> I can imagine "mixed" installation, where SANE drivers come sandboxed, 
> while simple-scan installed from a usual RPM or DEB package. This 
> "legacy-way" installed simple-scan will not be able to access SANE 
> drivers directly.
> 

Mixing is no problem.

If on the system you have installed the RPM or DEB of sane-airscan (with 
IPP Scan support), all SANE-using RPM- or DEB-installed applications use 
it. So they all can scan on a Scanner Application, independent whether 
it is sandboxed or not, as the when we sandbox a Scanner Application we 
take care that it can communicate with the network, at least with the 
involved services.

If we sadnbox the client, SANE-using application, we include the 
IPP-Scan-supporting sane-airscan in the package and allow the sandboxed 
application to access the network services needed to connet to Scanner 
Applications. We need to provide all scanner drivers as Scanner 
Application, as the sandboxed applications come only with sane-airscan 
and not with full sane-backends.

    Till