system: move system access packages

These packages loosely belong in the "system" package and "system" provides high level wrappers for all of them.

Signed-off-by: Ophestra <cat@gensokyo.uk>

33 files changed, 2717 insertions, 7 deletions

diff --git a/system/acl.go b/system/acl.go
index fe44ea5b..2efd7257 100644
--- a/system/acl.go
+++ b/system/acl.go
@@ -6,7 +6,7 @@ import (
 	"os"
 	"slices"
 
-	"git.gensokyo.uk/security/hakurei/acl"
+	"git.gensokyo.uk/security/hakurei/system/acl"
 )
 
 // UpdatePerm appends an ephemeral acl update Op.
diff --git a/system/acl/acl.go b/system/acl/acl.go
new file mode 100644
index 00000000..bc590db2
--- /dev/null
+++ b/system/acl/acl.go
@@ -0,0 +1,36 @@
+// Package acl implements simple ACL manipulation via libacl.
+package acl
+
+/*
+#cgo linux pkg-config: --static libacl
+
+#include "libacl-helper.h"
+*/
+import "C"
+
+type Perm C.acl_perm_t
+
+const (
+	Read    Perm = C.ACL_READ
+	Write   Perm = C.ACL_WRITE
+	Execute Perm = C.ACL_EXECUTE
+)
+
+// Update replaces ACL_USER entry with qualifier uid.
+func Update(name string, uid int, perms ...Perm) error {
+	var p *Perm
+	if len(perms) > 0 {
+		p = &perms[0]
+	}
+
+	r, err := C.hakurei_acl_update_file_by_uid(
+		C.CString(name),
+		C.uid_t(uid),
+		(*C.acl_perm_t)(p),
+		C.size_t(len(perms)),
+	)
+	if r == 0 {
+		return nil
+	}
+	return err
+}
diff --git a/system/acl/acl_getfacl_test.go b/system/acl/acl_getfacl_test.go
new file mode 100644
index 00000000..c20fade7
--- /dev/null
+++ b/system/acl/acl_getfacl_test.go
@@ -0,0 +1,156 @@
+package acl_test
+
+import (
+	"bufio"
+	"bytes"
+	"errors"
+	"fmt"
+	"io"
+	"os/exec"
+	"strconv"
+)
+
+type (
+	getFAclInvocation struct {
+		cmd *exec.Cmd
+		val []*getFAclResp
+		pe  []error
+	}
+
+	getFAclResp struct {
+		typ  fAclType
+		cred int32
+		val  fAclPerm
+
+		raw []byte
+	}
+
+	fAclPerm uintptr
+	fAclType uint8
+)
+
+const fAclBufSize = 16
+
+const (
+	fAclPermRead fAclPerm = 1 << iota
+	fAclPermWrite
+	fAclPermExecute
+)
+
+const (
+	fAclTypeUser fAclType = iota
+	fAclTypeGroup
+	fAclTypeMask
+	fAclTypeOther
+)
+
+func (c *getFAclInvocation) run(name string) error {
+	if c.cmd != nil {
+		panic("attempted to run twice")
+	}
+
+	c.cmd = exec.Command("getfacl", "--omit-header", "--absolute-names", "--numeric", name)
+
+	scanErr := make(chan error, 1)
+	if p, err := c.cmd.StdoutPipe(); err != nil {
+		return err
+	} else {
+		go c.parse(p, scanErr)
+	}
+
+	if err := c.cmd.Start(); err != nil {
+		return err
+	}
+
+	return errors.Join(<-scanErr, c.cmd.Wait())
+}
+
+func (c *getFAclInvocation) parse(pipe io.Reader, scanErr chan error) {
+	c.val = make([]*getFAclResp, 0, 4+fAclBufSize)
+
+	s := bufio.NewScanner(pipe)
+	for s.Scan() {
+		fields := bytes.SplitN(s.Bytes(), []byte{':'}, 3)
+		if len(fields) != 3 {
+			continue
+		}
+
+		resp := getFAclResp{}
+
+		switch string(fields[0]) {
+		case "user":
+			resp.typ = fAclTypeUser
+		case "group":
+			resp.typ = fAclTypeGroup
+		case "mask":
+			resp.typ = fAclTypeMask
+		case "other":
+			resp.typ = fAclTypeOther
+		default:
+			c.pe = append(c.pe, fmt.Errorf("unknown type %s", string(fields[0])))
+			continue
+		}
+
+		if len(fields[1]) == 0 {
+			resp.cred = -1
+		} else {
+			if cred, err := strconv.Atoi(string(fields[1])); err != nil {
+				c.pe = append(c.pe, err)
+				continue
+			} else {
+				resp.cred = int32(cred)
+				if resp.cred < 0 {
+					c.pe = append(c.pe, fmt.Errorf("credential %d out of range", resp.cred))
+					continue
+				}
+			}
+		}
+
+		if len(fields[2]) != 3 {
+			c.pe = append(c.pe, fmt.Errorf("invalid perm length %d", len(fields[2])))
+			continue
+		} else {
+			switch fields[2][0] {
+			case 'r':
+				resp.val |= fAclPermRead
+			case '-':
+			default:
+				c.pe = append(c.pe, fmt.Errorf("invalid perm %v", fields[2][0]))
+				continue
+			}
+			switch fields[2][1] {
+			case 'w':
+				resp.val |= fAclPermWrite
+			case '-':
+			default:
+				c.pe = append(c.pe, fmt.Errorf("invalid perm %v", fields[2][1]))
+				continue
+			}
+			switch fields[2][2] {
+			case 'x':
+				resp.val |= fAclPermExecute
+			case '-':
+			default:
+				c.pe = append(c.pe, fmt.Errorf("invalid perm %v", fields[2][2]))
+				continue
+			}
+		}
+
+		resp.raw = make([]byte, len(s.Bytes()))
+		copy(resp.raw, s.Bytes())
+		c.val = append(c.val, &resp)
+	}
+	scanErr <- s.Err()
+}
+
+func (r *getFAclResp) String() string {
+	if r.raw != nil && len(r.raw) > 0 {
+		return string(r.raw)
+	}
+
+	return "(user-initialised resp value)"
+}
+
+func (r *getFAclResp) equals(typ fAclType, cred int32, val fAclPerm) bool {
+	return r.typ == typ && r.cred == cred && r.val == val
+}
diff --git a/system/acl/acl_test.go b/system/acl/acl_test.go
new file mode 100644
index 00000000..bfb355e0
--- /dev/null
+++ b/system/acl/acl_test.go
@@ -0,0 +1,125 @@
+package acl_test
+
+import (
+	"errors"
+	"os"
+	"path"
+	"reflect"
+	"testing"
+
+	"git.gensokyo.uk/security/hakurei/system/acl"
+)
+
+const testFileName = "acl.test"
+
+var (
+	uid  = os.Geteuid()
+	cred = int32(os.Geteuid())
+)
+
+func TestUpdatePerm(t *testing.T) {
+	if os.Getenv("GO_TEST_SKIP_ACL") == "1" {
+		t.Log("acl test skipped")
+		t.SkipNow()
+	}
+
+	testFilePath := path.Join(t.TempDir(), testFileName)
+
+	if f, err := os.Create(testFilePath); err != nil {
+		t.Fatalf("Create: error = %v", err)
+	} else {
+		if err = f.Close(); err != nil {
+			t.Fatalf("Close: error = %v", err)
+		}
+	}
+	defer func() {
+		if err := os.Remove(testFilePath); err != nil {
+			t.Fatalf("Remove: error = %v", err)
+		}
+	}()
+
+	cur := getfacl(t, testFilePath)
+
+	t.Run("default entry count", func(t *testing.T) {
+		if len(cur) != 3 {
+			t.Fatalf("unexpected test file acl length %d", len(cur))
+		}
+	})
+
+	t.Run("default clear mask", func(t *testing.T) {
+		if err := acl.Update(testFilePath, uid); err != nil {
+			t.Fatalf("UpdatePerm: error = %v", err)
+		}
+		if cur = getfacl(t, testFilePath); len(cur) != 4 {
+			t.Fatalf("UpdatePerm: %v", cur)
+		}
+	})
+
+	t.Run("default clear consistency", func(t *testing.T) {
+		if err := acl.Update(testFilePath, uid); err != nil {
+			t.Fatalf("UpdatePerm: error = %v", err)
+		}
+		if val := getfacl(t, testFilePath); !reflect.DeepEqual(val, cur) {
+			t.Fatalf("UpdatePerm: %v, want %v", val, cur)
+		}
+	})
+
+	testUpdate(t, testFilePath, "r--", cur, fAclPermRead, acl.Read)
+	testUpdate(t, testFilePath, "-w-", cur, fAclPermWrite, acl.Write)
+	testUpdate(t, testFilePath, "--x", cur, fAclPermExecute, acl.Execute)
+	testUpdate(t, testFilePath, "-wx", cur, fAclPermWrite|fAclPermExecute, acl.Write, acl.Execute)
+	testUpdate(t, testFilePath, "r-x", cur, fAclPermRead|fAclPermExecute, acl.Read, acl.Execute)
+	testUpdate(t, testFilePath, "rw-", cur, fAclPermRead|fAclPermWrite, acl.Read, acl.Write)
+	testUpdate(t, testFilePath, "rwx", cur, fAclPermRead|fAclPermWrite|fAclPermExecute, acl.Read, acl.Write, acl.Execute)
+}
+
+func testUpdate(t *testing.T, testFilePath, name string, cur []*getFAclResp, val fAclPerm, perms ...acl.Perm) {
+	t.Run(name, func(t *testing.T) {
+		t.Cleanup(func() {
+			if err := acl.Update(testFilePath, uid); err != nil {
+				t.Fatalf("UpdatePerm: error = %v", err)
+			}
+			if v := getfacl(t, testFilePath); !reflect.DeepEqual(v, cur) {
+				t.Fatalf("UpdatePerm: %v, want %v", v, cur)
+			}
+		})
+
+		if err := acl.Update(testFilePath, uid, perms...); err != nil {
+			t.Fatalf("UpdatePerm: error = %v", err)
+		}
+		r := respByCred(getfacl(t, testFilePath), fAclTypeUser, cred)
+		if r == nil {
+			t.Fatalf("UpdatePerm did not add an ACL entry")
+		}
+		if !r.equals(fAclTypeUser, cred, val) {
+			t.Fatalf("UpdatePerm(%s) = %s", name, r)
+		}
+	})
+}
+
+func getfacl(t *testing.T, name string) []*getFAclResp {
+	c := new(getFAclInvocation)
+	if err := c.run(name); err != nil {
+		t.Fatalf("getfacl: error = %v", err)
+	}
+	if len(c.pe) != 0 {
+		t.Errorf("errors encountered parsing getfacl output\n%s", errors.Join(c.pe...).Error())
+	}
+	return c.val
+}
+
+func respByCred(v []*getFAclResp, typ fAclType, cred int32) *getFAclResp {
+	j := -1
+	for i, r := range v {
+		if r.typ == typ && r.cred == cred {
+			if j != -1 {
+				panic("invalid acl")
+			}
+			j = i
+		}
+	}
+	if j == -1 {
+		return nil
+	}
+	return v[j]
+}
diff --git a/system/acl/libacl-helper.c b/system/acl/libacl-helper.c
new file mode 100644
index 00000000..905cfa52
--- /dev/null
+++ b/system/acl/libacl-helper.c
@@ -0,0 +1,71 @@
+#include "libacl-helper.h"
+#include <acl/libacl.h>
+#include <stdbool.h>
+#include <stdlib.h>
+#include <sys/acl.h>
+
+int hakurei_acl_update_file_by_uid(const char *path_p, uid_t uid,
+                                   acl_perm_t *perms, size_t plen) {
+  int ret = -1;
+  bool v;
+  int i;
+  acl_t acl;
+  acl_entry_t entry;
+  acl_tag_t tag_type;
+  void *qualifier_p;
+  acl_permset_t permset;
+
+  acl = acl_get_file(path_p, ACL_TYPE_ACCESS);
+  if (acl == NULL)
+    goto out;
+
+  // prune entries by uid
+  for (i = acl_get_entry(acl, ACL_FIRST_ENTRY, &entry); i == 1;
+       i = acl_get_entry(acl, ACL_NEXT_ENTRY, &entry)) {
+    if (acl_get_tag_type(entry, &tag_type) != 0)
+      return -1;
+    if (tag_type != ACL_USER)
+      continue;
+
+    qualifier_p = acl_get_qualifier(entry);
+    if (qualifier_p == NULL)
+      return -1;
+    v = *(uid_t *)qualifier_p == uid;
+    acl_free(qualifier_p);
+
+    if (!v)
+      continue;
+
+    acl_delete_entry(acl, entry);
+  }
+
+  if (plen == 0)
+    goto set;
+
+  if (acl_create_entry(&acl, &entry) != 0)
+    goto out;
+  if (acl_get_permset(entry, &permset) != 0)
+    goto out;
+  for (i = 0; i < plen; i++) {
+    if (acl_add_perm(permset, perms[i]) != 0)
+      goto out;
+  }
+  if (acl_set_tag_type(entry, ACL_USER) != 0)
+    goto out;
+  if (acl_set_qualifier(entry, (void *)&uid) != 0)
+    goto out;
+
+set:
+  if (acl_calc_mask(&acl) != 0)
+    goto out;
+  if (acl_valid(acl) != 0)
+    goto out;
+  if (acl_set_file(path_p, ACL_TYPE_ACCESS, acl) == 0)
+    ret = 0;
+
+out:
+  free((void *)path_p);
+  if (acl != NULL)
+    acl_free((void *)acl);
+  return ret;
+}
diff --git a/system/acl/libacl-helper.h b/system/acl/libacl-helper.h
new file mode 100644
index 00000000..b86eb170
--- /dev/null
+++ b/system/acl/libacl-helper.h
@@ -0,0 +1,4 @@
+#include <sys/acl.h>
+
+int hakurei_acl_update_file_by_uid(const char *path_p, uid_t uid,
+                                   acl_perm_t *perms, size_t plen);
diff --git a/system/acl/perms.go b/system/acl/perms.go
new file mode 100644
index 00000000..fbc99e82
--- /dev/null
+++ b/system/acl/perms.go
@@ -0,0 +1,18 @@
+package acl
+
+type Perms []Perm
+
+func (ps Perms) String() string {
+	var s = []byte("---")
+	for _, p := range ps {
+		switch p {
+		case Read:
+			s[0] = 'r'
+		case Write:
+			s[1] = 'w'
+		case Execute:
+			s[2] = 'x'
+		}
+	}
+	return string(s)
+}
diff --git a/system/acl_test.go b/system/acl_test.go
index 5dcccd1d..f8f28323 100644
--- a/system/acl_test.go
+++ b/system/acl_test.go
@@ -3,7 +3,7 @@ package system
 import (
 	"testing"
 
-	"git.gensokyo.uk/security/hakurei/acl"
+	"git.gensokyo.uk/security/hakurei/system/acl"
 )
 
 func TestUpdatePerm(t *testing.T) {
diff --git a/system/dbus.go b/system/dbus.go
index f0532c4a..8ca20e70 100644
--- a/system/dbus.go
+++ b/system/dbus.go
@@ -9,7 +9,7 @@ import (
 	"sync"
 	"syscall"
 
-	"git.gensokyo.uk/security/hakurei/dbus"
+	"git.gensokyo.uk/security/hakurei/system/dbus"
 )
 
 var (
diff --git a/system/dbus/address.go b/system/dbus/address.go
new file mode 100644
index 00000000..bec49e62
--- /dev/null
+++ b/system/dbus/address.go
@@ -0,0 +1,186 @@
+package dbus
+
+import (
+	"bytes"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"slices"
+)
+
+type AddrEntry struct {
+	Method string      `json:"method"`
+	Values [][2]string `json:"values"`
+}
+
+// Parse parses D-Bus address according to
+// https://dbus.freedesktop.org/doc/dbus-specification.html#addresses
+func Parse(addr []byte) ([]AddrEntry, error) {
+	// Look for a semicolon
+	address := bytes.Split(bytes.TrimSuffix(addr, []byte{';'}), []byte{';'})
+
+	// Allocate for entries
+	v := make([]AddrEntry, len(address))
+
+	for i, s := range address {
+		var pairs [][]byte
+
+		// Look for the colon :
+		if method, list, ok := bytes.Cut(s, []byte{':'}); !ok {
+			return v, &BadAddressError{ErrNoColon, i, s, -1, nil}
+		} else {
+			pairs = bytes.Split(list, []byte{','})
+			v[i].Method = string(method)
+			v[i].Values = make([][2]string, len(pairs))
+		}
+
+		for j, pair := range pairs {
+			key, value, ok := bytes.Cut(pair, []byte{'='})
+			if !ok {
+				return v, &BadAddressError{ErrBadPairSep, i, s, j, pair}
+			}
+			if len(key) == 0 {
+				return v, &BadAddressError{ErrBadPairKey, i, s, j, pair}
+			}
+			if len(value) == 0 {
+				return v, &BadAddressError{ErrBadPairVal, i, s, j, pair}
+			}
+			v[i].Values[j][0] = string(key)
+
+			if val, errno := unescapeValue(value); errno != errSuccess {
+				return v, &BadAddressError{errno, i, s, j, pair}
+			} else {
+				v[i].Values[j][1] = string(val)
+			}
+		}
+	}
+
+	return v, nil
+}
+
+func unescapeValue(v []byte) (val []byte, errno ParseError) {
+	if l := len(v) - (bytes.Count(v, []byte{'%'}) * 2); l < 0 {
+		errno = ErrBadValLength
+		return
+	} else {
+		val = make([]byte, l)
+	}
+
+	var i, skip int
+	for iu, b := range v {
+		if skip > 0 {
+			skip--
+			continue
+		}
+
+		if ib := bytes.IndexByte([]byte("-_/.\\*"), b); ib != -1 { // - // _/.\*
+			goto opt
+		} else if b >= '0' && b <= '9' { // 0-9
+			goto opt
+		} else if b >= 'A' && b <= 'Z' { // A-Z
+			goto opt
+		} else if b >= 'a' && b <= 'z' { // a-z
+			goto opt
+		}
+
+		if b != '%' {
+			errno = ErrBadValByte
+			break
+		}
+
+		skip += 2
+		if iu+2 >= len(v) {
+			errno = ErrBadValHexLength
+			break
+		}
+		if c, err := hex.Decode(val[i:i+1], v[iu+1:iu+3]); err != nil {
+			if errors.As(err, new(hex.InvalidByteError)) {
+				errno = ErrBadValHexByte
+				break
+			}
+			// unreachable
+			panic(err.Error())
+		} else if c != 1 {
+			// unreachable
+			panic(fmt.Sprintf("invalid decode length %d", c))
+		}
+		i++
+		continue
+
+	opt:
+		val[i] = b
+		i++
+	}
+
+	return
+}
+
+type ParseError uint8
+
+func (e ParseError) Error() string {
+	switch e {
+	case errSuccess:
+		panic("attempted to return success as error")
+	case ErrNoColon:
+		return "address does not contain a colon"
+	case ErrBadPairSep:
+		return "'=' character not found"
+	case ErrBadPairKey:
+		return "'=' character has no key preceding it"
+	case ErrBadPairVal:
+		return "'=' character has no value following it"
+	case ErrBadValLength:
+		return "unescaped value has impossible length"
+	case ErrBadValByte:
+		return "in D-Bus address, characters other than [-0-9A-Za-z_/.\\*] should have been escaped"
+	case ErrBadValHexLength:
+		return "in D-Bus address, percent character was not followed by two hex digits"
+	case ErrBadValHexByte:
+		return "in D-Bus address, percent character was followed by characters other than hex digits"
+
+	default:
+		return fmt.Sprintf("parse error %d", e)
+	}
+}
+
+const (
+	errSuccess ParseError = iota
+	ErrNoColon
+	ErrBadPairSep
+	ErrBadPairKey
+	ErrBadPairVal
+	ErrBadValLength
+	ErrBadValByte
+	ErrBadValHexLength
+	ErrBadValHexByte
+)
+
+type BadAddressError struct {
+	// error type
+	Type ParseError
+
+	// bad entry position
+	EntryPos int
+	// bad entry value
+	EntryVal []byte
+
+	// bad pair position
+	PairPos int
+	// bad pair value
+	PairVal []byte
+}
+
+func (a *BadAddressError) Is(err error) bool {
+	var b *BadAddressError
+	return errors.As(err, &b) && a.Type == b.Type &&
+		a.EntryPos == b.EntryPos && slices.Equal(a.EntryVal, b.EntryVal) &&
+		a.PairPos == b.PairPos && slices.Equal(a.PairVal, b.PairVal)
+}
+
+func (a *BadAddressError) Error() string {
+	return a.Type.Error()
+}
+
+func (a *BadAddressError) Unwrap() error {
+	return a.Type
+}
diff --git a/system/dbus/address_escape_test.go b/system/dbus/address_escape_test.go
new file mode 100644
index 00000000..3ea2cd26
--- /dev/null
+++ b/system/dbus/address_escape_test.go
@@ -0,0 +1,55 @@
+package dbus
+
+import (
+	"testing"
+)
+
+func TestUnescapeValue(t *testing.T) {
+	testCases := []struct {
+		value   string
+		want    string
+		wantErr ParseError
+	}{
+		// upstream test cases
+		{value: "abcde", want: "abcde"},
+		{value: "", want: ""},
+		{value: "%20%20", want: "  "},
+		{value: "%24", want: "$"},
+		{value: "%25", want: "%"},
+		{value: "abc%24", want: "abc$"},
+		{value: "%24abc", want: "$abc"},
+		{value: "abc%24abc", want: "abc$abc"},
+		{value: "/", want: "/"},
+		{value: "-", want: "-"},
+		{value: "_", want: "_"},
+		{value: "A", want: "A"},
+		{value: "I", want: "I"},
+		{value: "Z", want: "Z"},
+		{value: "a", want: "a"},
+		{value: "i", want: "i"},
+		{value: "z", want: "z"},
+		/* Bug: https://bugs.freedesktop.org/show_bug.cgi?id=53499 */
+		{value: "%c3%b6", want: "\xc3\xb6"},
+
+		{value: "%a", wantErr: ErrBadValHexLength},
+		{value: "%q", wantErr: ErrBadValHexLength},
+		{value: "%az", wantErr: ErrBadValHexByte},
+		{value: "%%", wantErr: ErrBadValLength},
+		{value: "%$$", wantErr: ErrBadValHexByte},
+		{value: "abc%a", wantErr: ErrBadValHexLength},
+		{value: "%axyz", wantErr: ErrBadValHexByte},
+		{value: "%", wantErr: ErrBadValLength},
+		{value: "$", wantErr: ErrBadValByte},
+		{value: " ", wantErr: ErrBadValByte},
+	}
+
+	for _, tc := range testCases {
+		t.Run("unescape "+tc.value, func(t *testing.T) {
+			if got, errno := unescapeValue([]byte(tc.value)); errno != tc.wantErr {
+				t.Errorf("unescapeValue() errno = %v, wantErr %v", errno, tc.wantErr)
+			} else if tc.wantErr == errSuccess && string(got) != tc.want {
+				t.Errorf("unescapeValue() = %q, want %q", got, tc.want)
+			}
+		})
+	}
+}
diff --git a/system/dbus/address_test.go b/system/dbus/address_test.go
new file mode 100644
index 00000000..148bb092
--- /dev/null
+++ b/system/dbus/address_test.go
@@ -0,0 +1,119 @@
+package dbus_test
+
+import (
+	"errors"
+	"reflect"
+	"testing"
+
+	"git.gensokyo.uk/security/hakurei/system/dbus"
+)
+
+func TestParse(t *testing.T) {
+	testCases := []struct {
+		name    string
+		addr    string
+		want    []dbus.AddrEntry
+		wantErr error
+	}{
+		{
+			name: "simple session unix",
+			addr: "unix:path=/run/user/1971/bus",
+			want: []dbus.AddrEntry{{
+				Method: "unix",
+				Values: [][2]string{{"path", "/run/user/1971/bus"}},
+			}},
+		},
+		{
+			name: "simple upper escape",
+			addr: "debug:name=Test,cat=cute,escaped=%c3%b6",
+			want: []dbus.AddrEntry{{
+				Method: "debug",
+				Values: [][2]string{
+					{"name", "Test"},
+					{"cat", "cute"},
+					{"escaped", "\xc3\xb6"},
+				},
+			}},
+		},
+		{
+			name: "simple bad escape",
+			addr: "debug:name=%",
+			wantErr: &dbus.BadAddressError{Type: dbus.ErrBadValLength,
+				EntryPos: 0, EntryVal: []byte("debug:name=%"), PairPos: 0, PairVal: []byte("name=%")},
+		},
+
+		// upstream test cases
+		{
+			name: "full address success",
+			addr: "unix:path=/tmp/foo;debug:name=test,sliff=sloff;",
+			want: []dbus.AddrEntry{
+				{Method: "unix", Values: [][2]string{{"path", "/tmp/foo"}}},
+				{Method: "debug", Values: [][2]string{{"name", "test"}, {"sliff", "sloff"}}},
+			},
+		},
+		{
+			name: "empty address",
+			addr: "",
+			wantErr: &dbus.BadAddressError{Type: dbus.ErrNoColon,
+				EntryVal: []byte{}, PairPos: -1},
+		},
+		{
+			name: "no body",
+			addr: "foo",
+			wantErr: &dbus.BadAddressError{Type: dbus.ErrNoColon,
+				EntryPos: 0, EntryVal: []byte("foo"), PairPos: -1},
+		},
+		{
+			name: "no pair separator",
+			addr: "foo:bar",
+			wantErr: &dbus.BadAddressError{Type: dbus.ErrBadPairSep,
+				EntryPos: 0, EntryVal: []byte("foo:bar"), PairPos: 0, PairVal: []byte("bar")},
+		},
+		{
+			name: "no pair separator multi pair",
+			addr: "foo:bar,baz",
+			wantErr: &dbus.BadAddressError{Type: dbus.ErrBadPairSep,
+				EntryPos: 0, EntryVal: []byte("foo:bar,baz"), PairPos: 0, PairVal: []byte("bar")},
+		},
+		{
+			name: "no pair separator single valid pair",
+			addr: "foo:bar=foo,baz",
+			wantErr: &dbus.BadAddressError{Type: dbus.ErrBadPairSep,
+				EntryPos: 0, EntryVal: []byte("foo:bar=foo,baz"), PairPos: 1, PairVal: []byte("baz")},
+		},
+		{
+			name: "no body single valid address",
+			addr: "foo:bar=foo;baz",
+			wantErr: &dbus.BadAddressError{Type: dbus.ErrNoColon,
+				EntryPos: 1, EntryVal: []byte("baz"), PairPos: -1},
+		},
+		{
+			name: "no key",
+			addr: "foo:=foo",
+			wantErr: &dbus.BadAddressError{Type: dbus.ErrBadPairKey,
+				EntryPos: 0, EntryVal: []byte("foo:=foo"), PairPos: 0, PairVal: []byte("=foo")},
+		},
+		{
+			name: "no value",
+			addr: "foo:foo=",
+			wantErr: &dbus.BadAddressError{Type: dbus.ErrBadPairVal,
+				EntryPos: 0, EntryVal: []byte("foo:foo="), PairPos: 0, PairVal: []byte("foo=")},
+		},
+		{
+			name: "no pair separator single valid pair trailing",
+			addr: "foo:foo,bar=baz",
+			wantErr: &dbus.BadAddressError{Type: dbus.ErrBadPairSep,
+				EntryPos: 0, EntryVal: []byte("foo:foo,bar=baz"), PairPos: 0, PairVal: []byte("foo")},
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			if got, err := dbus.Parse([]byte(tc.addr)); !errors.Is(err, tc.wantErr) {
+				t.Errorf("Parse() error = %v, wantErr %v", err, tc.wantErr)
+			} else if tc.wantErr == nil && !reflect.DeepEqual(got, tc.want) {
+				t.Errorf("Parse() = %#v, want %#v", got, tc.want)
+			}
+		})
+	}
+}
diff --git a/system/dbus/config.go b/system/dbus/config.go
new file mode 100644
index 00000000..3f66b2bb
--- /dev/null
+++ b/system/dbus/config.go
@@ -0,0 +1,162 @@
+package dbus
+
+import (
+	"encoding/json"
+	"errors"
+	"io"
+	"os"
+	"strings"
+)
+
+// ProxyPair is an upstream dbus address and a downstream socket path.
+type ProxyPair [2]string
+
+type Config struct {
+	// See set 'see' policy for NAME (--see=NAME)
+	See []string `json:"see"`
+	// Talk set 'talk' policy for NAME (--talk=NAME)
+	Talk []string `json:"talk"`
+	// Own set 'own' policy for NAME (--own=NAME)
+	Own []string `json:"own"`
+
+	// Call set RULE for calls on NAME (--call=NAME=RULE)
+	Call map[string]string `json:"call"`
+	// Broadcast set RULE for broadcasts from NAME (--broadcast=NAME=RULE)
+	Broadcast map[string]string `json:"broadcast"`
+
+	Log    bool `json:"log,omitempty"`
+	Filter bool `json:"filter"`
+}
+
+func (c *Config) interfaces(yield func(string) bool) {
+	for _, iface := range c.See {
+		if !yield(iface) {
+			return
+		}
+	}
+	for _, iface := range c.Talk {
+		if !yield(iface) {
+			return
+		}
+	}
+	for _, iface := range c.Own {
+		if !yield(iface) {
+			return
+		}
+	}
+
+	for iface := range c.Call {
+		if !yield(iface) {
+			return
+		}
+	}
+	for iface := range c.Broadcast {
+		if !yield(iface) {
+			return
+		}
+	}
+}
+
+func (c *Config) checkInterfaces(segment string) error {
+	for iface := range c.interfaces {
+		/*
+			xdg-dbus-proxy fails without output when this condition is not met:
+				char *dot = strrchr (filter->interface, '.');
+				if (dot != NULL)
+				  {
+				    *dot = 0;
+				    if (strcmp (dot + 1, "*") != 0)
+				      filter->member = g_strdup (dot + 1);
+				  }
+
+			trim ".*" since they are removed before searching for '.':
+				if (g_str_has_suffix (name, ".*"))
+				  {
+				    name[strlen (name) - 2] = 0;
+				    wildcard = TRUE;
+				  }
+		*/
+		if strings.IndexByte(strings.TrimSuffix(iface, ".*"), '.') == -1 {
+			return &BadInterfaceError{iface, segment}
+		}
+	}
+	return nil
+}
+
+func (c *Config) Args(bus ProxyPair) (args []string) {
+	argc := 2 + len(c.See) + len(c.Talk) + len(c.Own) + len(c.Call) + len(c.Broadcast)
+	if c.Log {
+		argc++
+	}
+	if c.Filter {
+		argc++
+	}
+
+	args = make([]string, 0, argc)
+	args = append(args, bus[0], bus[1])
+	if c.Filter {
+		args = append(args, "--filter")
+	}
+	for _, name := range c.See {
+		args = append(args, "--see="+name)
+	}
+	for _, name := range c.Talk {
+		args = append(args, "--talk="+name)
+	}
+	for _, name := range c.Own {
+		args = append(args, "--own="+name)
+	}
+	for name, rule := range c.Call {
+		args = append(args, "--call="+name+"="+rule)
+	}
+	for name, rule := range c.Broadcast {
+		args = append(args, "--broadcast="+name+"="+rule)
+	}
+	if c.Log {
+		args = append(args, "--log")
+	}
+
+	return
+}
+
+func (c *Config) Load(r io.Reader) error { return json.NewDecoder(r).Decode(&c) }
+
+// NewConfigFromFile opens the target config file at path and parses its contents into *Config.
+func NewConfigFromFile(path string) (*Config, error) {
+	if f, err := os.Open(path); err != nil {
+		return nil, err
+	} else {
+		c := new(Config)
+		err1 := c.Load(f)
+		err = f.Close()
+
+		return c, errors.Join(err1, err)
+	}
+}
+
+// NewConfig returns a reference to a Config struct with optional defaults.
+// If id is an empty string own defaults are omitted.
+func NewConfig(id string, defaults, mpris bool) (c *Config) {
+	c = &Config{
+		Call:      make(map[string]string),
+		Broadcast: make(map[string]string),
+
+		Filter: true,
+	}
+
+	if defaults {
+		c.Talk = []string{"org.freedesktop.DBus", "org.freedesktop.Notifications"}
+
+		c.Call["org.freedesktop.portal.*"] = "*"
+		c.Broadcast["org.freedesktop.portal.*"] = "@/org/freedesktop/portal/*"
+
+		if id != "" {
+			c.Own = []string{id + ".*"}
+			if mpris {
+				c.Own = append(c.Own, "org.mpris.MediaPlayer2."+id+".*")
+			}
+		}
+	}
+
+	return
+}
diff --git a/system/dbus/config_test.go b/system/dbus/config_test.go
new file mode 100644
index 00000000..f79c4c50
--- /dev/null
+++ b/system/dbus/config_test.go
@@ -0,0 +1,159 @@
+package dbus_test
+
+import (
+	"errors"
+	"os"
+	"path"
+	"reflect"
+	"slices"
+	"strings"
+	"testing"
+
+	"git.gensokyo.uk/security/hakurei/system/dbus"
+)
+
+func TestConfig_Args(t *testing.T) {
+	for _, tc := range makeTestCases() {
+		if tc.wantErr {
+			// args does not check for nulls
+			continue
+		}
+
+		t.Run("build arguments for "+tc.id, func(t *testing.T) {
+			if got := tc.c.Args(tc.bus); !slices.Equal(got, tc.want) {
+				t.Errorf("Args(%q) = %v, want %v",
+					tc.bus,
+					got, tc.want)
+			}
+		})
+	}
+}
+
+func TestNewConfigFromFile(t *testing.T) {
+	for _, tc := range makeTestCases() {
+		name := new(strings.Builder)
+		name.WriteString("parse configuration file for application ")
+		name.WriteString(tc.id)
+		if tc.wantErr {
+			name.WriteString(" with unexpected results")
+		}
+
+		samplePath := path.Join("testdata", tc.id+".json")
+
+		t.Run(name.String(), func(t *testing.T) {
+			got, err := dbus.NewConfigFromFile(samplePath)
+			if errors.Is(err, os.ErrNotExist) != tc.wantErrF {
+				t.Errorf("NewConfigFromFile(%q) error = %v, wantErrF %v",
+					samplePath,
+					err, tc.wantErrF)
+				return
+			}
+
+			if tc.wantErrF {
+				return
+			}
+
+			if !tc.wantErr && !reflect.DeepEqual(got, tc.c) {
+				t.Errorf("NewConfigFromFile(%q) got = %v, want %v",
+					samplePath,
+					got, tc.c)
+			}
+			if tc.wantErr && reflect.DeepEqual(got, tc.c) {
+				t.Errorf("NewConfigFromFile(%q) got = %v, wantErr %v",
+					samplePath,
+					got, tc.wantErr)
+			}
+		})
+	}
+}
+
+func TestNewConfig(t *testing.T) {
+	ids := [...]string{"org.chromium.Chromium", "dev.vencord.Vesktop"}
+
+	type newTestCase struct {
+		id   string
+		args [2]bool
+		want *dbus.Config
+	}
+
+	// populate tests from IDs in generic tests
+	tcs := make([]newTestCase, 0, (len(ids)+1)*4)
+	// tests for defaults without id
+	tcs = append(tcs,
+		newTestCase{"", [2]bool{false, false}, &dbus.Config{
+			Call:      make(map[string]string),
+			Broadcast: make(map[string]string),
+			Filter:    true,
+		}},
+		newTestCase{"", [2]bool{false, true}, &dbus.Config{
+			Call:      make(map[string]string),
+			Broadcast: make(map[string]string),
+			Filter:    true,
+		}},
+		newTestCase{"", [2]bool{true, false}, &dbus.Config{
+			Talk:      []string{"org.freedesktop.DBus", "org.freedesktop.Notifications"},
+			Call:      map[string]string{"org.freedesktop.portal.*": "*"},
+			Broadcast: map[string]string{"org.freedesktop.portal.*": "@/org/freedesktop/portal/*"},
+			Filter:    true,
+		}},
+		newTestCase{"", [2]bool{true, true}, &dbus.Config{
+			Talk:      []string{"org.freedesktop.DBus", "org.freedesktop.Notifications"},
+			Call:      map[string]string{"org.freedesktop.portal.*": "*"},
+			Broadcast: map[string]string{"org.freedesktop.portal.*": "@/org/freedesktop/portal/*"},
+			Filter:    true,
+		}},
+	)
+	for _, id := range ids {
+		tcs = append(tcs,
+			newTestCase{id, [2]bool{false, false}, &dbus.Config{
+				Call:      make(map[string]string),
+				Broadcast: make(map[string]string),
+				Filter:    true,
+			}},
+			newTestCase{id, [2]bool{false, true}, &dbus.Config{
+				Call:      make(map[string]string),
+				Broadcast: make(map[string]string),
+				Filter:    true,
+			}},
+			newTestCase{id, [2]bool{true, false}, &dbus.Config{
+				Talk:      []string{"org.freedesktop.DBus", "org.freedesktop.Notifications"},
+				Own:       []string{id + ".*"},
+				Call:      map[string]string{"org.freedesktop.portal.*": "*"},
+				Broadcast: map[string]string{"org.freedesktop.portal.*": "@/org/freedesktop/portal/*"},
+				Filter:    true,
+			}},
+			newTestCase{id, [2]bool{true, true}, &dbus.Config{
+				Talk:      []string{"org.freedesktop.DBus", "org.freedesktop.Notifications"},
+				Own:       []string{id + ".*", "org.mpris.MediaPlayer2." + id + ".*"},
+				Call:      map[string]string{"org.freedesktop.portal.*": "*"},
+				Broadcast: map[string]string{"org.freedesktop.portal.*": "@/org/freedesktop/portal/*"},
+				Filter:    true,
+			}},
+		)
+	}
+
+	for _, tc := range tcs {
+		name := new(strings.Builder)
+		name.WriteString("create new configuration struct")
+
+		if tc.args[0] {
+			name.WriteString(" with builtin defaults")
+			if tc.args[1] {
+				name.WriteString(" (mpris)")
+			}
+		}
+
+		if tc.id != "" {
+			name.WriteString(" for application ID ")
+			name.WriteString(tc.id)
+		}
+
+		t.Run(name.String(), func(t *testing.T) {
+			if gotC := dbus.NewConfig(tc.id, tc.args[0], tc.args[1]); !reflect.DeepEqual(gotC, tc.want) {
+				t.Errorf("NewConfig(%q, %t, %t) = %v, want %v",
+					tc.id, tc.args[0], tc.args[1],
+					gotC, tc.want)
+			}
+		})
+	}
+}
diff --git a/system/dbus/dbus.go b/system/dbus/dbus.go
new file mode 100644
index 00000000..c5b4e812
--- /dev/null
+++ b/system/dbus/dbus.go
@@ -0,0 +1,40 @@
+// Package dbus wraps xdg-dbus-proxy and implements configuration and sandboxing of the underlying helper process.
+package dbus
+
+import (
+	"fmt"
+	"os"
+	"sync"
+)
+
+const (
+	SessionBusAddress = "DBUS_SESSION_BUS_ADDRESS"
+	SystemBusAddress  = "DBUS_SYSTEM_BUS_ADDRESS"
+)
+
+var (
+	addresses   [2]string
+	addressOnce sync.Once
+)
+
+func Address() (session, system string) {
+	addressOnce.Do(func() {
+		// resolve upstream session bus address
+		if addr, ok := os.LookupEnv(SessionBusAddress); !ok {
+			// fall back to default format
+			addresses[0] = fmt.Sprintf("unix:path=/run/user/%d/bus", os.Getuid())
+		} else {
+			addresses[0] = addr
+		}
+
+		// resolve upstream system bus address
+		if addr, ok := os.LookupEnv(SystemBusAddress); !ok {
+			// fall back to default hardcoded value
+			addresses[1] = "unix:path=/run/dbus/system_bus_socket"
+		} else {
+			addresses[1] = addr
+		}
+	})
+
+	return addresses[0], addresses[1]
+}
diff --git a/system/dbus/dbus_test.go b/system/dbus/dbus_test.go
new file mode 100644
index 00000000..7b1e1858
--- /dev/null
+++ b/system/dbus/dbus_test.go
@@ -0,0 +1,213 @@
+package dbus_test
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"os/exec"
+	"strings"
+	"syscall"
+	"testing"
+	"time"
+
+	"git.gensokyo.uk/security/hakurei"
+	"git.gensokyo.uk/security/hakurei/helper"
+	"git.gensokyo.uk/security/hakurei/internal"
+	"git.gensokyo.uk/security/hakurei/internal/hlog"
+	"git.gensokyo.uk/security/hakurei/system/dbus"
+)
+
+func TestFinalise(t *testing.T) {
+	if _, err := dbus.Finalise(dbus.ProxyPair{}, dbus.ProxyPair{}, nil, nil); !errors.Is(err, syscall.EBADE) {
+		t.Errorf("Finalise: error = %v, want %v",
+			err, syscall.EBADE)
+	}
+
+	for id, tc := range testCasePairs() {
+		t.Run("create final for "+id, func(t *testing.T) {
+			var wt io.WriterTo
+			if v, err := dbus.Finalise(tc[0].bus, tc[1].bus, tc[0].c, tc[1].c); (errors.Is(err, syscall.EINVAL)) != tc[0].wantErr {
+				t.Errorf("Finalise: error = %v, wantErr %v",
+					err, tc[0].wantErr)
+				return
+			} else {
+				wt = v
+			}
+
+			// rest of the tests happen for sealed instances
+			if tc[0].wantErr {
+				return
+			}
+
+			// build null-terminated string from wanted args
+			want := new(strings.Builder)
+			args := append(tc[0].want, tc[1].want...)
+			for _, arg := range args {
+				want.WriteString(arg)
+				want.WriteByte(0)
+			}
+
+			got := new(strings.Builder)
+			if _, err := wt.WriteTo(got); err != nil {
+				t.Errorf("WriteTo: error = %v", err)
+			}
+
+			if want.String() != got.String() {
+				t.Errorf("Seal: %q, want %q",
+					got.String(), want.String())
+			}
+		})
+	}
+}
+
+func TestProxyStartWaitCloseString(t *testing.T) {
+	oldWaitDelay := helper.WaitDelay
+	helper.WaitDelay = 16 * time.Second
+	t.Cleanup(func() { helper.WaitDelay = oldWaitDelay })
+
+	t.Run("sandbox", func(t *testing.T) {
+		proxyName := dbus.ProxyName
+		dbus.ProxyName = os.Args[0]
+		t.Cleanup(func() { dbus.ProxyName = proxyName })
+		testProxyFinaliseStartWaitCloseString(t, true)
+	})
+	t.Run("direct", func(t *testing.T) { testProxyFinaliseStartWaitCloseString(t, false) })
+}
+
+func testProxyFinaliseStartWaitCloseString(t *testing.T, useSandbox bool) {
+	var p *dbus.Proxy
+
+	t.Run("string for nil proxy", func(t *testing.T) {
+		want := "(invalid dbus proxy)"
+		if got := p.String(); got != want {
+			t.Errorf("String: %q, want %q",
+				got, want)
+		}
+	})
+
+	t.Run("invalid start", func(t *testing.T) {
+		if !useSandbox {
+			p = dbus.NewDirect(t.Context(), nil, nil)
+		} else {
+			p = dbus.New(t.Context(), nil, nil)
+		}
+
+		if err := p.Start(); !errors.Is(err, syscall.ENOTRECOVERABLE) {
+			t.Errorf("Start: error = %q, wantErr %q",
+				err, syscall.ENOTRECOVERABLE)
+			return
+		}
+	})
+
+	for id, tc := range testCasePairs() {
+		// this test does not test errors
+		if tc[0].wantErr {
+			continue
+		}
+
+		t.Run("proxy for "+id, func(t *testing.T) {
+			var final *dbus.Final
+			t.Run("finalise", func(t *testing.T) {
+				if v, err := dbus.Finalise(tc[0].bus, tc[1].bus, tc[0].c, tc[1].c); err != nil {
+					t.Errorf("Finalise: error = %v, wantErr %v",
+						err, tc[0].wantErr)
+					return
+				} else {
+					final = v
+				}
+			})
+
+			ctx, cancel := context.WithTimeout(t.Context(), 5*time.Second)
+			defer cancel()
+			if !useSandbox {
+				p = dbus.NewDirect(ctx, final, nil)
+			} else {
+				p = dbus.New(ctx, final, nil)
+			}
+
+			p.CommandContext = func(ctx context.Context) (cmd *exec.Cmd) {
+				return exec.CommandContext(ctx, os.Args[0], "-test.v",
+					"-test.run=TestHelperInit", "--", "init")
+			}
+			p.CmdF = func(v any) {
+				if useSandbox {
+					container := v.(*hakurei.Container)
+					if container.Args[0] != dbus.ProxyName {
+						panic(fmt.Sprintf("unexpected argv0 %q", os.Args[0]))
+					}
+					container.Args = append([]string{os.Args[0], "-test.run=TestHelperStub", "--"}, container.Args[1:]...)
+				} else {
+					cmd := v.(*exec.Cmd)
+					if cmd.Args[0] != dbus.ProxyName {
+						panic(fmt.Sprintf("unexpected argv0 %q", os.Args[0]))
+					}
+					cmd.Err = nil
+					cmd.Path = os.Args[0]
+					cmd.Args = append([]string{os.Args[0], "-test.run=TestHelperStub", "--"}, cmd.Args[1:]...)
+				}
+			}
+			p.FilterF = func(v []byte) []byte { return bytes.SplitN(v, []byte("TestHelperInit\n"), 2)[1] }
+			output := new(strings.Builder)
+
+			t.Run("invalid wait", func(t *testing.T) {
+				wantErr := "dbus: not started"
+				if err := p.Wait(); err == nil || err.Error() != wantErr {
+					t.Errorf("Wait: error = %v, wantErr %v",
+						err, wantErr)
+				}
+			})
+
+			t.Run("string", func(t *testing.T) {
+				want := "(unused dbus proxy)"
+				if got := p.String(); got != want {
+					t.Errorf("String: %q, want %q",
+						got, want)
+					return
+				}
+			})
+
+			t.Run("start", func(t *testing.T) {
+				if err := p.Start(); err != nil {
+					t.Fatalf("Start: error = %v",
+						err)
+				}
+
+				t.Run("string", func(t *testing.T) {
+					wantSubstr := fmt.Sprintf("%s -test.run=TestHelperStub -- --args=3 --fd=4", os.Args[0])
+					if useSandbox {
+						wantSubstr = fmt.Sprintf(`argv: ["%s" "-test.run=TestHelperStub" "--" "--args=3" "--fd=4"], filter: true, rules: 0, flags: 0x1, presets: 0xf`, os.Args[0])
+					}
+					if got := p.String(); !strings.Contains(got, wantSubstr) {
+						t.Errorf("String: %q, want %q",
+							got, wantSubstr)
+						return
+					}
+				})
+
+				t.Run("wait", func(t *testing.T) {
+					done := make(chan struct{})
+					go func() {
+						if err := p.Wait(); err != nil {
+							t.Errorf("Wait: error = %v\noutput: %s",
+								err, output.String())
+						}
+						close(done)
+					}()
+					p.Close()
+					<-done
+				})
+			})
+		})
+	}
+}
+
+func TestHelperInit(t *testing.T) {
+	if len(os.Args) != 5 || os.Args[4] != "init" {
+		return
+	}
+	hakurei.SetOutput(hlog.Output{})
+	hakurei.Init(hlog.Prepare, internal.InstallOutput)
+}
diff --git a/system/dbus/export_test.go b/system/dbus/export_test.go
new file mode 100644
index 00000000..574a4a73
--- /dev/null
+++ b/system/dbus/export_test.go
@@ -0,0 +1,13 @@
+package dbus
+
+import (
+	"context"
+	"io"
+)
+
+// NewDirect returns a new instance of [Proxy] with its sandbox disabled.
+func NewDirect(ctx context.Context, final *Final, output io.Writer) *Proxy {
+	p := New(ctx, final, output)
+	p.useSandbox = false
+	return p
+}
diff --git a/system/dbus/proc.go b/system/dbus/proc.go
new file mode 100644
index 00000000..e8cccd5f
--- /dev/null
+++ b/system/dbus/proc.go
@@ -0,0 +1,189 @@
+package dbus
+
+import (
+	"context"
+	"errors"
+	"os"
+	"os/exec"
+	"path"
+	"path/filepath"
+	"slices"
+	"strconv"
+	"syscall"
+
+	"git.gensokyo.uk/security/hakurei"
+	"git.gensokyo.uk/security/hakurei/helper"
+	"git.gensokyo.uk/security/hakurei/ldd"
+	"git.gensokyo.uk/security/hakurei/seccomp"
+)
+
+// Start starts and configures a D-Bus proxy process.
+func (p *Proxy) Start() error {
+	if p.final == nil || p.final.WriterTo == nil {
+		return syscall.ENOTRECOVERABLE
+	}
+
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	p.pmu.Lock()
+	defer p.pmu.Unlock()
+
+	if p.cancel != nil || p.cause != nil {
+		return errors.New("dbus: already started")
+	}
+
+	ctx, cancel := context.WithCancelCause(p.ctx)
+
+	if !p.useSandbox {
+		p.helper = helper.NewDirect(ctx, p.name, p.final, true, argF, func(cmd *exec.Cmd) {
+			if p.CmdF != nil {
+				p.CmdF(cmd)
+			}
+			if p.output != nil {
+				cmd.Stdout, cmd.Stderr = p.output, p.output
+			}
+			cmd.SysProcAttr = &syscall.SysProcAttr{Setpgid: true}
+			cmd.Env = make([]string, 0)
+		}, nil)
+	} else {
+		toolPath := p.name
+		if filepath.Base(p.name) == p.name {
+			if s, err := exec.LookPath(p.name); err != nil {
+				return err
+			} else {
+				toolPath = s
+			}
+		}
+
+		var libPaths []string
+		if entries, err := ldd.ExecFilter(ctx, p.CommandContext, p.FilterF, toolPath); err != nil {
+			return err
+		} else {
+			libPaths = ldd.Path(entries)
+		}
+
+		p.helper = helper.New(
+			ctx, toolPath,
+			p.final, true,
+			argF, func(container *hakurei.Container) {
+				container.SeccompFlags |= seccomp.AllowMultiarch
+				container.SeccompPresets |= seccomp.PresetStrict
+				container.Hostname = "hakurei-dbus"
+				container.CommandContext = p.CommandContext
+				if p.output != nil {
+					container.Stdout, container.Stderr = p.output, p.output
+				}
+
+				if p.CmdF != nil {
+					p.CmdF(container)
+				}
+
+				// these lib paths are unpredictable, so mount them first so they cannot cover anything
+				for _, name := range libPaths {
+					container.Bind(name, name, 0)
+				}
+
+				// upstream bus directories
+				upstreamPaths := make([]string, 0, 2)
+				for _, addr := range [][]AddrEntry{p.final.SessionUpstream, p.final.SystemUpstream} {
+					for _, ent := range addr {
+						if ent.Method != "unix" {
+							continue
+						}
+						for _, pair := range ent.Values {
+							if pair[0] != "path" || !path.IsAbs(pair[1]) {
+								continue
+							}
+							upstreamPaths = append(upstreamPaths, path.Dir(pair[1]))
+						}
+					}
+				}
+				slices.Sort(upstreamPaths)
+				upstreamPaths = slices.Compact(upstreamPaths)
+				for _, name := range upstreamPaths {
+					container.Bind(name, name, 0)
+				}
+
+				// parent directories of bind paths
+				sockDirPaths := make([]string, 0, 2)
+				if d := path.Dir(p.final.Session[1]); path.IsAbs(d) {
+					sockDirPaths = append(sockDirPaths, d)
+				}
+				if d := path.Dir(p.final.System[1]); path.IsAbs(d) {
+					sockDirPaths = append(sockDirPaths, d)
+				}
+				slices.Sort(sockDirPaths)
+				sockDirPaths = slices.Compact(sockDirPaths)
+				for _, name := range sockDirPaths {
+					container.Bind(name, name, hakurei.BindWritable)
+				}
+
+				// xdg-dbus-proxy bin path
+				binPath := path.Dir(toolPath)
+				container.Bind(binPath, binPath, 0)
+			}, nil)
+	}
+
+	if err := p.helper.Start(); err != nil {
+		cancel(err)
+		p.helper = nil
+		return err
+	}
+
+	p.cancel, p.cause = cancel, func() error { return context.Cause(ctx) }
+	return nil
+}
+
+var proxyClosed = errors.New("proxy closed")
+
+// Wait blocks until xdg-dbus-proxy exits and releases resources.
+func (p *Proxy) Wait() error {
+	p.mu.RLock()
+	defer p.mu.RUnlock()
+
+	p.pmu.RLock()
+	if p.helper == nil || p.cancel == nil || p.cause == nil {
+		p.pmu.RUnlock()
+		return errors.New("dbus: not started")
+	}
+
+	errs := make([]error, 3)
+
+	errs[0] = p.helper.Wait()
+	if errors.Is(errs[0], context.Canceled) &&
+		errors.Is(p.cause(), proxyClosed) {
+		errs[0] = nil
+	}
+	p.pmu.RUnlock()
+
+	// ensure socket removal so ephemeral directory is empty at revert
+	if err := os.Remove(p.final.Session[1]); err != nil && !errors.Is(err, os.ErrNotExist) {
+		errs[1] = err
+	}
+	if p.final.System[1] != "" {
+		if err := os.Remove(p.final.System[1]); err != nil && !errors.Is(err, os.ErrNotExist) {
+			errs[2] = err
+		}
+	}
+
+	return errors.Join(errs...)
+}
+
+// Close cancels the context passed to the helper instance attached to xdg-dbus-proxy.
+func (p *Proxy) Close() {
+	p.pmu.Lock()
+	defer p.pmu.Unlock()
+
+	if p.cancel == nil {
+		panic("dbus: not started")
+	}
+	p.cancel(proxyClosed)
+}
+
+func argF(argsFd, statFd int) []string {
+	if statFd == -1 {
+		return []string{"--args=" + strconv.Itoa(argsFd)}
+	} else {
+		return []string{"--args=" + strconv.Itoa(argsFd), "--fd=" + strconv.Itoa(statFd)}
+	}
+}
diff --git a/system/dbus/proxy.go b/system/dbus/proxy.go
new file mode 100644
index 00000000..cc0af1ea
--- /dev/null
+++ b/system/dbus/proxy.go
@@ -0,0 +1,117 @@
+package dbus
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"os/exec"
+	"sync"
+	"syscall"
+
+	"git.gensokyo.uk/security/hakurei/helper"
+)
+
+// ProxyName is the file name or path to the proxy program.
+// Overriding ProxyName will only affect Proxy instance created after the change.
+var ProxyName = "xdg-dbus-proxy"
+
+type BadInterfaceError struct {
+	Interface string
+	Segment   string
+}
+
+func (e *BadInterfaceError) Error() string {
+	return fmt.Sprintf("bad interface string %q in %s bus configuration", e.Interface, e.Segment)
+}
+
+// Proxy holds the state of a xdg-dbus-proxy process, and should never be copied.
+type Proxy struct {
+	helper helper.Helper
+	ctx    context.Context
+
+	cancel context.CancelCauseFunc
+	cause  func() error
+
+	final      *Final
+	output     io.Writer
+	useSandbox bool
+
+	name string
+	CmdF func(any)
+
+	CommandContext func(ctx context.Context) (cmd *exec.Cmd)
+	FilterF        func([]byte) []byte
+
+	mu, pmu sync.RWMutex
+}
+
+func (p *Proxy) String() string {
+	if p == nil {
+		return "(invalid dbus proxy)"
+	}
+
+	p.mu.RLock()
+	defer p.mu.RUnlock()
+
+	if p.helper != nil {
+		return p.helper.String()
+	}
+
+	return "(unused dbus proxy)"
+}
+
+// Final describes the outcome of a proxy configuration.
+type Final struct {
+	Session, System ProxyPair
+	// parsed upstream address
+	SessionUpstream, SystemUpstream []AddrEntry
+	io.WriterTo
+}
+
+// Finalise creates a checked argument writer for [Proxy].
+func Finalise(sessionBus, systemBus ProxyPair, session, system *Config) (final *Final, err error) {
+	if session == nil && system == nil {
+		return nil, syscall.EBADE
+	}
+
+	var args []string
+	if session != nil {
+		if err = session.checkInterfaces("session"); err != nil {
+			return
+		}
+		args = append(args, session.Args(sessionBus)...)
+	}
+	if system != nil {
+		if err = system.checkInterfaces("system"); err != nil {
+			return
+		}
+		args = append(args, system.Args(systemBus)...)
+	}
+
+	final = &Final{Session: sessionBus, System: systemBus}
+
+	final.WriterTo, err = helper.NewCheckedArgs(args)
+	if err != nil {
+		return
+	}
+
+	if session != nil {
+		final.SessionUpstream, err = Parse([]byte(final.Session[0]))
+		if err != nil {
+			return
+		}
+	}
+	if system != nil {
+		final.SystemUpstream, err = Parse([]byte(final.System[0]))
+		if err != nil {
+			return
+		}
+	}
+
+	return
+}
+
+// New returns a new instance of [Proxy].
+func New(ctx context.Context, final *Final, output io.Writer) *Proxy {
+	return &Proxy{name: ProxyName, ctx: ctx, final: final, output: output, useSandbox: true}
+}
diff --git a/system/dbus/samples_test.go b/system/dbus/samples_test.go
new file mode 100644
index 00000000..a5c6f273
--- /dev/null
+++ b/system/dbus/samples_test.go
@@ -0,0 +1,228 @@
+package dbus_test
+
+import (
+	"sync"
+
+	"git.gensokyo.uk/security/hakurei/system/dbus"
+)
+
+const (
+	sampleHostPath = "/tmp/bus"
+	sampleHostAddr = "unix:path=" + sampleHostPath
+	sampleBindPath = "/tmp/proxied_bus"
+)
+
+var samples = []dbusTestCase{
+	{
+		"org.chromium.Chromium", &dbus.Config{
+			See: nil,
+			Talk: []string{"org.freedesktop.Notifications", "org.freedesktop.FileManager1", "org.freedesktop.ScreenSaver",
+				"org.freedesktop.secrets", "org.kde.kwalletd5", "org.kde.kwalletd6", "org.gnome.SessionManager"},
+			Own: []string{"org.chromium.Chromium.*", "org.mpris.MediaPlayer2.org.chromium.Chromium.*",
+				"org.mpris.MediaPlayer2.chromium.*"},
+			Call:      map[string]string{"org.freedesktop.portal.*": "*"},
+			Broadcast: map[string]string{"org.freedesktop.portal.*": "@/org/freedesktop/portal/*"},
+			Log:       false,
+			Filter:    true,
+		}, false, false,
+		[2]string{sampleHostAddr, sampleBindPath},
+		[]string{
+			sampleHostAddr,
+			sampleBindPath,
+			"--filter",
+			"--talk=org.freedesktop.Notifications",
+			"--talk=org.freedesktop.FileManager1",
+			"--talk=org.freedesktop.ScreenSaver",
+			"--talk=org.freedesktop.secrets",
+			"--talk=org.kde.kwalletd5",
+			"--talk=org.kde.kwalletd6",
+			"--talk=org.gnome.SessionManager",
+			"--own=org.chromium.Chromium.*",
+			"--own=org.mpris.MediaPlayer2.org.chromium.Chromium.*",
+			"--own=org.mpris.MediaPlayer2.chromium.*",
+			"--call=org.freedesktop.portal.*=*",
+			"--broadcast=org.freedesktop.portal.*=@/org/freedesktop/portal/*",
+		},
+	},
+	{
+		"org.chromium.Chromium+", &dbus.Config{
+			See:       nil,
+			Talk:      []string{"org.bluez", "org.freedesktop.Avahi", "org.freedesktop.UPower"},
+			Own:       nil,
+			Call:      nil,
+			Broadcast: nil,
+			Log:       false,
+			Filter:    true,
+		}, false, false,
+		[2]string{sampleHostAddr, sampleBindPath},
+		[]string{
+			sampleHostAddr,
+			sampleBindPath,
+			"--filter",
+			"--talk=org.bluez",
+			"--talk=org.freedesktop.Avahi",
+			"--talk=org.freedesktop.UPower",
+		},
+	},
+
+	{
+		"dev.vencord.Vesktop", &dbus.Config{
+			See:       nil,
+			Talk:      []string{"org.freedesktop.Notifications", "org.kde.StatusNotifierWatcher"},
+			Own:       []string{"dev.vencord.Vesktop.*", "org.mpris.MediaPlayer2.dev.vencord.Vesktop.*"},
+			Call:      map[string]string{"org.freedesktop.portal.*": "*"},
+			Broadcast: map[string]string{"org.freedesktop.portal.*": "@/org/freedesktop/portal/*"},
+			Log:       false,
+			Filter:    true,
+		}, false, false,
+		[2]string{sampleHostAddr, sampleBindPath},
+		[]string{
+			sampleHostAddr,
+			sampleBindPath,
+			"--filter",
+			"--talk=org.freedesktop.Notifications",
+			"--talk=org.kde.StatusNotifierWatcher",
+			"--own=dev.vencord.Vesktop.*",
+			"--own=org.mpris.MediaPlayer2.dev.vencord.Vesktop.*",
+			"--call=org.freedesktop.portal.*=*",
+			"--broadcast=org.freedesktop.portal.*=@/org/freedesktop/portal/*"},
+	},
+
+	{
+		"uk.gensokyo.CrashTestDummy", &dbus.Config{
+			See:       []string{"uk.gensokyo.CrashTestDummy1"},
+			Talk:      []string{"org.freedesktop.Notifications"},
+			Own:       []string{"uk.gensokyo.CrashTestDummy.*", "org.mpris.MediaPlayer2.uk.gensokyo.CrashTestDummy.*"},
+			Call:      map[string]string{"org.freedesktop.portal.*": "*"},
+			Broadcast: map[string]string{"org.freedesktop.portal.*": "@/org/freedesktop/portal/*"},
+			Log:       true,
+			Filter:    true,
+		}, false, false,
+		[2]string{sampleHostAddr, sampleBindPath},
+		[]string{
+			sampleHostAddr,
+			sampleBindPath,
+			"--filter",
+			"--see=uk.gensokyo.CrashTestDummy1",
+			"--talk=org.freedesktop.Notifications",
+			"--own=uk.gensokyo.CrashTestDummy.*",
+			"--own=org.mpris.MediaPlayer2.uk.gensokyo.CrashTestDummy.*",
+			"--call=org.freedesktop.portal.*=*",
+			"--broadcast=org.freedesktop.portal.*=@/org/freedesktop/portal/*",
+			"--log"},
+	},
+	{
+		"uk.gensokyo.CrashTestDummy1", &dbus.Config{
+			See:       []string{"uk.gensokyo.CrashTestDummy"},
+			Talk:      []string{"org.freedesktop.Notifications"},
+			Own:       []string{"uk.gensokyo.CrashTestDummy1.*", "org.mpris.MediaPlayer2.uk.gensokyo.CrashTestDummy1.*"},
+			Call:      map[string]string{"org.freedesktop.portal.*": "*"},
+			Broadcast: map[string]string{"org.freedesktop.portal.*": "@/org/freedesktop/portal/*"},
+			Log:       true,
+			Filter:    true,
+		}, false, true,
+		[2]string{sampleHostAddr, sampleBindPath},
+		[]string{
+			sampleHostAddr,
+			sampleBindPath,
+			"--filter",
+			"--see=uk.gensokyo.CrashTestDummy",
+			"--talk=org.freedesktop.Notifications",
+			"--own=uk.gensokyo.CrashTestDummy1.*",
+			"--own=org.mpris.MediaPlayer2.uk.gensokyo.CrashTestDummy1.*",
+			"--call=org.freedesktop.portal.*=*",
+			"--broadcast=org.freedesktop.portal.*=@/org/freedesktop/portal/*",
+			"--log"},
+	},
+}
+
+type dbusTestCase struct {
+	id       string
+	c        *dbus.Config
+	wantErr  bool
+	wantErrF bool
+	bus      [2]string
+	want     []string
+}
+
+var (
+	testCasesV     []dbusTestCase
+	testCasePairsV map[string][2]dbusTestCase
+
+	testCaseOnce sync.Once
+)
+
+func makeTestCases() []dbusTestCase {
+	testCaseOnce.Do(testCaseGenerate)
+	return testCasesV
+}
+
+func testCasePairs() map[string][2]dbusTestCase {
+	testCaseOnce.Do(testCaseGenerate)
+	return testCasePairsV
+}
+
+func injectNulls(t *[]string) {
+	f := make([]string, len(*t))
+	for i := range f {
+		f[i] = "\x00" + (*t)[i] + "\x00"
+	}
+	*t = f
+}
+
+func testCaseGenerate() {
+	// create null-injected test cases
+	testCasesV = make([]dbusTestCase, len(samples)*2)
+	for i := range samples {
+		testCasesV[i] = samples[i]
+		testCasesV[len(samples)+i] = samples[i]
+		testCasesV[len(samples)+i].c = new(dbus.Config)
+		*testCasesV[len(samples)+i].c = *samples[i].c
+
+		// inject nulls
+		fi := &testCasesV[len(samples)+i]
+		fi.wantErr = true
+
+		injectNulls(&fi.c.See)
+		injectNulls(&fi.c.Talk)
+		injectNulls(&fi.c.Own)
+	}
+
+	// enumerate test case pairs
+	var pc int
+	for _, tc := range samples {
+		if tc.id != "" {
+			pc++
+		}
+	}
+	testCasePairsV = make(map[string][2]dbusTestCase, pc)
+	for i, tc := range testCasesV {
+		if tc.id == "" {
+			continue
+		}
+
+		// skip already enumerated system bus test
+		if tc.id[len(tc.id)-1] == '+' {
+			continue
+		}
+
+		ftp := [2]dbusTestCase{tc}
+
+		// system proxy tests always place directly after its user counterpart with id ending in +
+		if i+1 < len(testCasesV) && testCasesV[i+1].id[len(testCasesV[i+1].id)-1] == '+' {
+			// attach system bus config
+			ftp[1] = testCasesV[i+1]
+
+			// check for misplaced/mismatching tests
+			if ftp[0].wantErr != ftp[1].wantErr || ftp[0].id+"+" != ftp[1].id {
+				panic("mismatching session/system pairing")
+			}
+		}
+
+		k := tc.id
+		if tc.wantErr {
+			k = "malformed_" + k
+		}
+		testCasePairsV[k] = ftp
+	}
+}
diff --git a/system/dbus/stub_test.go b/system/dbus/stub_test.go
new file mode 100644
index 00000000..b05efd61
--- /dev/null
+++ b/system/dbus/stub_test.go
@@ -0,0 +1,9 @@
+package dbus_test
+
+import (
+	"testing"
+
+	"git.gensokyo.uk/security/hakurei/helper"
+)
+
+func TestHelperStub(t *testing.T) { helper.InternalHelperStub() }
diff --git a/system/dbus/testdata/dev.vencord.Vesktop.json b/system/dbus/testdata/dev.vencord.Vesktop.json
new file mode 100644
index 00000000..05259774
--- /dev/null
+++ b/system/dbus/testdata/dev.vencord.Vesktop.json
@@ -0,0 +1,18 @@
+{
+  "talk":[
+    "org.freedesktop.Notifications",
+    "org.kde.StatusNotifierWatcher"
+  ],
+  "own":[
+    "dev.vencord.Vesktop.*",
+    "org.mpris.MediaPlayer2.dev.vencord.Vesktop.*"
+  ],
+  "call":{
+    "org.freedesktop.portal.*":"*"
+  },
+  "broadcast":{
+    "org.freedesktop.portal.*":"@/org/freedesktop/portal/*"
+  },
+
+  "filter":true
+}
diff --git a/system/dbus/testdata/org.chromium.Chromium+.json b/system/dbus/testdata/org.chromium.Chromium+.json
new file mode 100644
index 00000000..0a27d719
--- /dev/null
+++ b/system/dbus/testdata/org.chromium.Chromium+.json
@@ -0,0 +1,9 @@
+{
+  "talk":[
+    "org.bluez",
+    "org.freedesktop.Avahi",
+    "org.freedesktop.UPower"
+  ],
+
+  "filter":true
+}
\ No newline at end of file
diff --git a/system/dbus/testdata/org.chromium.Chromium.json b/system/dbus/testdata/org.chromium.Chromium.json
new file mode 100644
index 00000000..be027f39
--- /dev/null
+++ b/system/dbus/testdata/org.chromium.Chromium.json
@@ -0,0 +1,24 @@
+{
+  "talk":[
+    "org.freedesktop.Notifications",
+    "org.freedesktop.FileManager1",
+    "org.freedesktop.ScreenSaver",
+    "org.freedesktop.secrets",
+    "org.kde.kwalletd5",
+    "org.kde.kwalletd6",
+    "org.gnome.SessionManager"
+  ],
+  "own":[
+    "org.chromium.Chromium.*",
+    "org.mpris.MediaPlayer2.org.chromium.Chromium.*",
+    "org.mpris.MediaPlayer2.chromium.*"
+  ],
+  "call":{
+    "org.freedesktop.portal.*":"*"
+  },
+  "broadcast":{
+    "org.freedesktop.portal.*":"@/org/freedesktop/portal/*"
+  },
+
+  "filter":true
+}
diff --git a/system/dbus/testdata/uk.gensokyo.CrashTestDummy.json b/system/dbus/testdata/uk.gensokyo.CrashTestDummy.json
new file mode 100644
index 00000000..43272f67
--- /dev/null
+++ b/system/dbus/testdata/uk.gensokyo.CrashTestDummy.json
@@ -0,0 +1,21 @@
+{
+  "see": [
+    "uk.gensokyo.CrashTestDummy1"
+  ],
+  "talk":[
+    "org.freedesktop.Notifications"
+  ],
+  "own":[
+    "uk.gensokyo.CrashTestDummy.*",
+    "org.mpris.MediaPlayer2.uk.gensokyo.CrashTestDummy.*"
+  ],
+  "call":{
+    "org.freedesktop.portal.*":"*"
+  },
+  "broadcast":{
+    "org.freedesktop.portal.*":"@/org/freedesktop/portal/*"
+  },
+
+  "log": true,
+  "filter":true
+}
diff --git a/system/wayland.go b/system/wayland.go
index cb547406..a485b3f2 100644
--- a/system/wayland.go
+++ b/system/wayland.go
@@ -5,8 +5,8 @@ import (
 	"fmt"
 	"os"
 
-	"git.gensokyo.uk/security/hakurei/acl"
-	"git.gensokyo.uk/security/hakurei/sandbox/wl"
+	"git.gensokyo.uk/security/hakurei/system/acl"
+	"git.gensokyo.uk/security/hakurei/system/wayland"
 )
 
 // Wayland sets up a wayland socket with a security context attached.
@@ -14,7 +14,7 @@ func (sys *I) Wayland(syncFd **os.File, dst, src, appID, instanceID string) *I {
 	sys.lock.Lock()
 	defer sys.lock.Unlock()
 
-	sys.ops = append(sys.ops, &Wayland{syncFd, dst, src, appID, instanceID, wl.Conn{}})
+	sys.ops = append(sys.ops, &Wayland{syncFd, dst, src, appID, instanceID, wayland.Conn{}})
 
 	return sys
 }
@@ -24,7 +24,7 @@ type Wayland struct {
 	dst, src          string
 	appID, instanceID string
 
-	conn wl.Conn
+	conn wayland.Conn
 }
 
 func (w *Wayland) Type() Enablement { return Process }
diff --git a/system/wayland/conn.go b/system/wayland/conn.go
new file mode 100644
index 00000000..a930fc01
--- /dev/null
+++ b/system/wayland/conn.go
@@ -0,0 +1,121 @@
+// Package wayland implements Wayland security_context_v1 protocol.
+package wayland
+
+import (
+	"errors"
+	"net"
+	"os"
+	"runtime"
+	"sync"
+	"syscall"
+)
+
+type Conn struct {
+	conn *net.UnixConn
+
+	done     chan struct{}
+	doneOnce sync.Once
+
+	mu sync.Mutex
+}
+
+// Attach connects Conn to a wayland socket.
+func (c *Conn) Attach(p string) (err error) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	if c.conn != nil {
+		return errors.New("attached")
+	}
+
+	c.conn, err = net.DialUnix("unix", nil, &net.UnixAddr{Name: p, Net: "unix"})
+	return
+}
+
+// Close releases resources and closes the connection to the wayland compositor.
+func (c *Conn) Close() error {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	if c.done == nil {
+		return errors.New("no socket bound")
+	}
+
+	c.doneOnce.Do(func() {
+		c.done <- struct{}{}
+		<-c.done
+	})
+
+	// closed by wayland
+	runtime.SetFinalizer(c.conn, nil)
+	return nil
+}
+
+func (c *Conn) Bind(p, appID, instanceID string) (*os.File, error) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	if c.conn == nil {
+		return nil, errors.New("not attached")
+	}
+	if c.done != nil {
+		return nil, errors.New("bound")
+	}
+
+	if rc, err := c.conn.SyscallConn(); err != nil {
+		// unreachable
+		return nil, err
+	} else {
+		c.done = make(chan struct{})
+		return bindRawConn(c.done, rc, p, appID, instanceID)
+	}
+}
+
+func bindRawConn(done chan struct{}, rc syscall.RawConn, p, appID, instanceID string) (*os.File, error) {
+	var syncPipe [2]*os.File
+
+	if r, w, err := os.Pipe(); err != nil {
+		return nil, err
+	} else {
+		syncPipe[0] = r
+		syncPipe[1] = w
+	}
+
+	setupDone := make(chan error, 1) // does not block with c.done
+
+	go func() {
+		if err := rc.Control(func(fd uintptr) {
+			// prevent runtime from closing the read end of sync fd
+			runtime.SetFinalizer(syncPipe[0], nil)
+
+			// allow the Bind method to return after setup
+			setupDone <- bind(fd, p, appID, instanceID, syncPipe[0].Fd())
+			close(setupDone)
+
+			// keep socket alive until done is requested
+			<-done
+			runtime.KeepAlive(syncPipe[1])
+		}); err != nil {
+			setupDone <- err
+		}
+
+		// notify Close that rc.Control has returned
+		close(done)
+	}()
+
+	// return write end of the pipe
+	return syncPipe[1], <-setupDone
+}
+
+func bind(fd uintptr, p, appID, instanceID string, syncFd uintptr) error {
+	// ensure p is available
+	if f, err := os.Create(p); err != nil {
+		return err
+	} else if err = f.Close(); err != nil {
+		return err
+	} else if err = os.Remove(p); err != nil {
+		return err
+	}
+
+	return bindWaylandFd(p, fd, appID, instanceID, syncFd)
+}
diff --git a/system/wayland/consts.go b/system/wayland/consts.go
new file mode 100644
index 00000000..672e6392
--- /dev/null
+++ b/system/wayland/consts.go
@@ -0,0 +1,15 @@
+package wayland
+
+const (
+	// WaylandDisplay contains the name of the server socket
+	// (https://gitlab.freedesktop.org/wayland/wayland/-/blob/1.23.1/src/wayland-client.c#L1147)
+	// which is concatenated with XDG_RUNTIME_DIR
+	// (https://gitlab.freedesktop.org/wayland/wayland/-/blob/1.23.1/src/wayland-client.c#L1171)
+	// or used as-is if absolute
+	// (https://gitlab.freedesktop.org/wayland/wayland/-/blob/1.23.1/src/wayland-client.c#L1176).
+	WaylandDisplay = "WAYLAND_DISPLAY"
+
+	// FallbackName is used as the wayland socket name if WAYLAND_DISPLAY is unset
+	// (https://gitlab.freedesktop.org/wayland/wayland/-/blob/1.23.1/src/wayland-client.c#L1149).
+	FallbackName = "wayland-0"
+)
diff --git a/system/wayland/security-context-v1-protocol.c b/system/wayland/security-context-v1-protocol.c
new file mode 100644
index 00000000..5b15b1b4
--- /dev/null
+++ b/system/wayland/security-context-v1-protocol.c
@@ -0,0 +1,74 @@
+/* Generated by wayland-scanner 1.23.1 */
+
+/*
+ * Copyright © 2021 Simon Ser
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the next
+ * paragraph) shall be included in all copies or substantial portions of the
+ * Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
+ */
+
+#include <stdbool.h>
+#include <stdlib.h>
+#include <stdint.h>
+#include "wayland-util.h"
+
+#ifndef __has_attribute
+# define __has_attribute(x) 0  /* Compatibility with non-clang compilers. */
+#endif
+
+#if (__has_attribute(visibility) || defined(__GNUC__) && __GNUC__ >= 4)
+#define WL_PRIVATE __attribute__ ((visibility("hidden")))
+#else
+#define WL_PRIVATE
+#endif
+
+extern const struct wl_interface wp_security_context_v1_interface;
+
+static const struct wl_interface *security_context_v1_types[] = {
+	NULL,
+	&wp_security_context_v1_interface,
+	NULL,
+	NULL,
+};
+
+static const struct wl_message wp_security_context_manager_v1_requests[] = {
+	{ "destroy", "", security_context_v1_types + 0 },
+	{ "create_listener", "nhh", security_context_v1_types + 1 },
+};
+
+WL_PRIVATE const struct wl_interface wp_security_context_manager_v1_interface = {
+	"wp_security_context_manager_v1", 1,
+	2, wp_security_context_manager_v1_requests,
+	0, NULL,
+};
+
+static const struct wl_message wp_security_context_v1_requests[] = {
+	{ "destroy", "", security_context_v1_types + 0 },
+	{ "set_sandbox_engine", "s", security_context_v1_types + 0 },
+	{ "set_app_id", "s", security_context_v1_types + 0 },
+	{ "set_instance_id", "s", security_context_v1_types + 0 },
+	{ "commit", "", security_context_v1_types + 0 },
+};
+
+WL_PRIVATE const struct wl_interface wp_security_context_v1_interface = {
+	"wp_security_context_v1", 1,
+	5, wp_security_context_v1_requests,
+	0, NULL,
+};
+
diff --git a/system/wayland/security-context-v1-protocol.h b/system/wayland/security-context-v1-protocol.h
new file mode 100644
index 00000000..f973619e
--- /dev/null
+++ b/system/wayland/security-context-v1-protocol.h
@@ -0,0 +1,392 @@
+/* Generated by wayland-scanner 1.23.1 */
+
+#ifndef SECURITY_CONTEXT_V1_CLIENT_PROTOCOL_H
+#define SECURITY_CONTEXT_V1_CLIENT_PROTOCOL_H
+
+#include <stdint.h>
+#include <stddef.h>
+#include "wayland-client.h"
+
+#ifdef  __cplusplus
+extern "C" {
+#endif
+
+/**
+ * @page page_security_context_v1 The security_context_v1 protocol
+ * @section page_ifaces_security_context_v1 Interfaces
+ * - @subpage page_iface_wp_security_context_manager_v1 - client security context manager
+ * - @subpage page_iface_wp_security_context_v1 - client security context
+ * @section page_copyright_security_context_v1 Copyright
+ * <pre>
+ *
+ * Copyright © 2021 Simon Ser
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the next
+ * paragraph) shall be included in all copies or substantial portions of the
+ * Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
+ * </pre>
+ */
+struct wp_security_context_manager_v1;
+struct wp_security_context_v1;
+
+#ifndef WP_SECURITY_CONTEXT_MANAGER_V1_INTERFACE
+#define WP_SECURITY_CONTEXT_MANAGER_V1_INTERFACE
+/**
+ * @page page_iface_wp_security_context_manager_v1 wp_security_context_manager_v1
+ * @section page_iface_wp_security_context_manager_v1_desc Description
+ *
+ * This interface allows a client to register a new Wayland connection to
+ * the compositor and attach a security context to it.
+ *
+ * This is intended to be used by sandboxes. Sandbox engines attach a
+ * security context to all connections coming from inside the sandbox. The
+ * compositor can then restrict the features that the sandboxed connections
+ * can use.
+ *
+ * Compositors should forbid nesting multiple security contexts by not
+ * exposing wp_security_context_manager_v1 global to clients with a security
+ * context attached, or by sending the nested protocol error. Nested
+ * security contexts are dangerous because they can potentially allow
+ * privilege escalation of a sandboxed client.
+ *
+ * Warning! The protocol described in this file is currently in the testing
+ * phase. Backward compatible changes may be added together with the
+ * corresponding interface version bump. Backward incompatible changes can
+ * only be done by creating a new major version of the extension.
+ * @section page_iface_wp_security_context_manager_v1_api API
+ * See @ref iface_wp_security_context_manager_v1.
+ */
+/**
+ * @defgroup iface_wp_security_context_manager_v1 The wp_security_context_manager_v1 interface
+ *
+ * This interface allows a client to register a new Wayland connection to
+ * the compositor and attach a security context to it.
+ *
+ * This is intended to be used by sandboxes. Sandbox engines attach a
+ * security context to all connections coming from inside the sandbox. The
+ * compositor can then restrict the features that the sandboxed connections
+ * can use.
+ *
+ * Compositors should forbid nesting multiple security contexts by not
+ * exposing wp_security_context_manager_v1 global to clients with a security
+ * context attached, or by sending the nested protocol error. Nested
+ * security contexts are dangerous because they can potentially allow
+ * privilege escalation of a sandboxed client.
+ *
+ * Warning! The protocol described in this file is currently in the testing
+ * phase. Backward compatible changes may be added together with the
+ * corresponding interface version bump. Backward incompatible changes can
+ * only be done by creating a new major version of the extension.
+ */
+extern const struct wl_interface wp_security_context_manager_v1_interface;
+#endif
+#ifndef WP_SECURITY_CONTEXT_V1_INTERFACE
+#define WP_SECURITY_CONTEXT_V1_INTERFACE
+/**
+ * @page page_iface_wp_security_context_v1 wp_security_context_v1
+ * @section page_iface_wp_security_context_v1_desc Description
+ *
+ * The security context allows a client to register a new client and attach
+ * security context metadata to the connections.
+ *
+ * When both are set, the combination of the application ID and the sandbox
+ * engine must uniquely identify an application. The same application ID
+ * will be used across instances (e.g. if the application is restarted, or
+ * if the application is started multiple times).
+ *
+ * When both are set, the combination of the instance ID and the sandbox
+ * engine must uniquely identify a running instance of an application.
+ * @section page_iface_wp_security_context_v1_api API
+ * See @ref iface_wp_security_context_v1.
+ */
+/**
+ * @defgroup iface_wp_security_context_v1 The wp_security_context_v1 interface
+ *
+ * The security context allows a client to register a new client and attach
+ * security context metadata to the connections.
+ *
+ * When both are set, the combination of the application ID and the sandbox
+ * engine must uniquely identify an application. The same application ID
+ * will be used across instances (e.g. if the application is restarted, or
+ * if the application is started multiple times).
+ *
+ * When both are set, the combination of the instance ID and the sandbox
+ * engine must uniquely identify a running instance of an application.
+ */
+extern const struct wl_interface wp_security_context_v1_interface;
+#endif
+
+#ifndef WP_SECURITY_CONTEXT_MANAGER_V1_ERROR_ENUM
+#define WP_SECURITY_CONTEXT_MANAGER_V1_ERROR_ENUM
+enum wp_security_context_manager_v1_error {
+	/**
+	 * listening socket FD is invalid
+	 */
+	WP_SECURITY_CONTEXT_MANAGER_V1_ERROR_INVALID_LISTEN_FD = 1,
+	/**
+	 * nested security contexts are forbidden
+	 */
+	WP_SECURITY_CONTEXT_MANAGER_V1_ERROR_NESTED = 2,
+};
+#endif /* WP_SECURITY_CONTEXT_MANAGER_V1_ERROR_ENUM */
+
+#define WP_SECURITY_CONTEXT_MANAGER_V1_DESTROY 0
+#define WP_SECURITY_CONTEXT_MANAGER_V1_CREATE_LISTENER 1
+
+
+/**
+ * @ingroup iface_wp_security_context_manager_v1
+ */
+#define WP_SECURITY_CONTEXT_MANAGER_V1_DESTROY_SINCE_VERSION 1
+/**
+ * @ingroup iface_wp_security_context_manager_v1
+ */
+#define WP_SECURITY_CONTEXT_MANAGER_V1_CREATE_LISTENER_SINCE_VERSION 1
+
+/** @ingroup iface_wp_security_context_manager_v1 */
+static inline void
+wp_security_context_manager_v1_set_user_data(struct wp_security_context_manager_v1 *wp_security_context_manager_v1, void *user_data)
+{
+	wl_proxy_set_user_data((struct wl_proxy *) wp_security_context_manager_v1, user_data);
+}
+
+/** @ingroup iface_wp_security_context_manager_v1 */
+static inline void *
+wp_security_context_manager_v1_get_user_data(struct wp_security_context_manager_v1 *wp_security_context_manager_v1)
+{
+	return wl_proxy_get_user_data((struct wl_proxy *) wp_security_context_manager_v1);
+}
+
+static inline uint32_t
+wp_security_context_manager_v1_get_version(struct wp_security_context_manager_v1 *wp_security_context_manager_v1)
+{
+	return wl_proxy_get_version((struct wl_proxy *) wp_security_context_manager_v1);
+}
+
+/**
+ * @ingroup iface_wp_security_context_manager_v1
+ *
+ * Destroy the manager. This doesn't destroy objects created with the
+ * manager.
+ */
+static inline void
+wp_security_context_manager_v1_destroy(struct wp_security_context_manager_v1 *wp_security_context_manager_v1)
+{
+	wl_proxy_marshal_flags((struct wl_proxy *) wp_security_context_manager_v1,
+			 WP_SECURITY_CONTEXT_MANAGER_V1_DESTROY, NULL, wl_proxy_get_version((struct wl_proxy *) wp_security_context_manager_v1), WL_MARSHAL_FLAG_DESTROY);
+}
+
+/**
+ * @ingroup iface_wp_security_context_manager_v1
+ *
+ * Creates a new security context with a socket listening FD.
+ *
+ * The compositor will accept new client connections on listen_fd.
+ * listen_fd must be ready to accept new connections when this request is
+ * sent by the client. In other words, the client must call bind(2) and
+ * listen(2) before sending the FD.
+ *
+ * close_fd is a FD that will signal hangup when the compositor should stop
+ * accepting new connections on listen_fd.
+ *
+ * The compositor must continue to accept connections on listen_fd when
+ * the Wayland client which created the security context disconnects.
+ *
+ * After sending this request, closing listen_fd and close_fd remains the
+ * only valid operation on them.
+ */
+static inline struct wp_security_context_v1 *
+wp_security_context_manager_v1_create_listener(struct wp_security_context_manager_v1 *wp_security_context_manager_v1, int32_t listen_fd, int32_t close_fd)
+{
+	struct wl_proxy *id;
+
+	id = wl_proxy_marshal_flags((struct wl_proxy *) wp_security_context_manager_v1,
+			 WP_SECURITY_CONTEXT_MANAGER_V1_CREATE_LISTENER, &wp_security_context_v1_interface, wl_proxy_get_version((struct wl_proxy *) wp_security_context_manager_v1), 0, NULL, listen_fd, close_fd);
+
+	return (struct wp_security_context_v1 *) id;
+}
+
+#ifndef WP_SECURITY_CONTEXT_V1_ERROR_ENUM
+#define WP_SECURITY_CONTEXT_V1_ERROR_ENUM
+enum wp_security_context_v1_error {
+	/**
+	 * security context has already been committed
+	 */
+	WP_SECURITY_CONTEXT_V1_ERROR_ALREADY_USED = 1,
+	/**
+	 * metadata has already been set
+	 */
+	WP_SECURITY_CONTEXT_V1_ERROR_ALREADY_SET = 2,
+	/**
+	 * metadata is invalid
+	 */
+	WP_SECURITY_CONTEXT_V1_ERROR_INVALID_METADATA = 3,
+};
+#endif /* WP_SECURITY_CONTEXT_V1_ERROR_ENUM */
+
+#define WP_SECURITY_CONTEXT_V1_DESTROY 0
+#define WP_SECURITY_CONTEXT_V1_SET_SANDBOX_ENGINE 1
+#define WP_SECURITY_CONTEXT_V1_SET_APP_ID 2
+#define WP_SECURITY_CONTEXT_V1_SET_INSTANCE_ID 3
+#define WP_SECURITY_CONTEXT_V1_COMMIT 4
+
+
+/**
+ * @ingroup iface_wp_security_context_v1
+ */
+#define WP_SECURITY_CONTEXT_V1_DESTROY_SINCE_VERSION 1
+/**
+ * @ingroup iface_wp_security_context_v1
+ */
+#define WP_SECURITY_CONTEXT_V1_SET_SANDBOX_ENGINE_SINCE_VERSION 1
+/**
+ * @ingroup iface_wp_security_context_v1
+ */
+#define WP_SECURITY_CONTEXT_V1_SET_APP_ID_SINCE_VERSION 1
+/**
+ * @ingroup iface_wp_security_context_v1
+ */
+#define WP_SECURITY_CONTEXT_V1_SET_INSTANCE_ID_SINCE_VERSION 1
+/**
+ * @ingroup iface_wp_security_context_v1
+ */
+#define WP_SECURITY_CONTEXT_V1_COMMIT_SINCE_VERSION 1
+
+/** @ingroup iface_wp_security_context_v1 */
+static inline void
+wp_security_context_v1_set_user_data(struct wp_security_context_v1 *wp_security_context_v1, void *user_data)
+{
+	wl_proxy_set_user_data((struct wl_proxy *) wp_security_context_v1, user_data);
+}
+
+/** @ingroup iface_wp_security_context_v1 */
+static inline void *
+wp_security_context_v1_get_user_data(struct wp_security_context_v1 *wp_security_context_v1)
+{
+	return wl_proxy_get_user_data((struct wl_proxy *) wp_security_context_v1);
+}
+
+static inline uint32_t
+wp_security_context_v1_get_version(struct wp_security_context_v1 *wp_security_context_v1)
+{
+	return wl_proxy_get_version((struct wl_proxy *) wp_security_context_v1);
+}
+
+/**
+ * @ingroup iface_wp_security_context_v1
+ *
+ * Destroy the security context object.
+ */
+static inline void
+wp_security_context_v1_destroy(struct wp_security_context_v1 *wp_security_context_v1)
+{
+	wl_proxy_marshal_flags((struct wl_proxy *) wp_security_context_v1,
+			 WP_SECURITY_CONTEXT_V1_DESTROY, NULL, wl_proxy_get_version((struct wl_proxy *) wp_security_context_v1), WL_MARSHAL_FLAG_DESTROY);
+}
+
+/**
+ * @ingroup iface_wp_security_context_v1
+ *
+ * Attach a unique sandbox engine name to the security context. The name
+ * should follow the reverse-DNS style (e.g. "org.flatpak").
+ *
+ * A list of well-known engines is maintained at:
+ * https://gitlab.freedesktop.org/wayland/wayland-protocols/-/blob/main/staging/security-context/engines.md
+ *
+ * It is a protocol error to call this request twice. The already_set
+ * error is sent in this case.
+ */
+static inline void
+wp_security_context_v1_set_sandbox_engine(struct wp_security_context_v1 *wp_security_context_v1, const char *name)
+{
+	wl_proxy_marshal_flags((struct wl_proxy *) wp_security_context_v1,
+			 WP_SECURITY_CONTEXT_V1_SET_SANDBOX_ENGINE, NULL, wl_proxy_get_version((struct wl_proxy *) wp_security_context_v1), 0, name);
+}
+
+/**
+ * @ingroup iface_wp_security_context_v1
+ *
+ * Attach an application ID to the security context.
+ *
+ * The application ID is an opaque, sandbox-specific identifier for an
+ * application. See the well-known engines document for more details:
+ * https://gitlab.freedesktop.org/wayland/wayland-protocols/-/blob/main/staging/security-context/engines.md
+ *
+ * The compositor may use the application ID to group clients belonging to
+ * the same security context application.
+ *
+ * Whether this request is optional or not depends on the sandbox engine used.
+ *
+ * It is a protocol error to call this request twice. The already_set
+ * error is sent in this case.
+ */
+static inline void
+wp_security_context_v1_set_app_id(struct wp_security_context_v1 *wp_security_context_v1, const char *app_id)
+{
+	wl_proxy_marshal_flags((struct wl_proxy *) wp_security_context_v1,
+			 WP_SECURITY_CONTEXT_V1_SET_APP_ID, NULL, wl_proxy_get_version((struct wl_proxy *) wp_security_context_v1), 0, app_id);
+}
+
+/**
+ * @ingroup iface_wp_security_context_v1
+ *
+ * Attach an instance ID to the security context.
+ *
+ * The instance ID is an opaque, sandbox-specific identifier for a running
+ * instance of an application. See the well-known engines document for
+ * more details:
+ * https://gitlab.freedesktop.org/wayland/wayland-protocols/-/blob/main/staging/security-context/engines.md
+ *
+ * Whether this request is optional or not depends on the sandbox engine used.
+ *
+ * It is a protocol error to call this request twice. The already_set
+ * error is sent in this case.
+ */
+static inline void
+wp_security_context_v1_set_instance_id(struct wp_security_context_v1 *wp_security_context_v1, const char *instance_id)
+{
+	wl_proxy_marshal_flags((struct wl_proxy *) wp_security_context_v1,
+			 WP_SECURITY_CONTEXT_V1_SET_INSTANCE_ID, NULL, wl_proxy_get_version((struct wl_proxy *) wp_security_context_v1), 0, instance_id);
+}
+
+/**
+ * @ingroup iface_wp_security_context_v1
+ *
+ * Atomically register the new client and attach the security context
+ * metadata.
+ *
+ * If the provided metadata is inconsistent or does not match with out of
+ * band metadata (see
+ * https://gitlab.freedesktop.org/wayland/wayland-protocols/-/blob/main/staging/security-context/engines.md),
+ * the invalid_metadata error may be sent eventually.
+ *
+ * It's a protocol error to send any request other than "destroy" after
+ * this request. In this case, the already_used error is sent.
+ */
+static inline void
+wp_security_context_v1_commit(struct wp_security_context_v1 *wp_security_context_v1)
+{
+	wl_proxy_marshal_flags((struct wl_proxy *) wp_security_context_v1,
+			 WP_SECURITY_CONTEXT_V1_COMMIT, NULL, wl_proxy_get_version((struct wl_proxy *) wp_security_context_v1), 0);
+}
+
+#ifdef  __cplusplus
+}
+#endif
+
+#endif
diff --git a/system/wayland/wayland-client-helper.c b/system/wayland/wayland-client-helper.c
new file mode 100644
index 00000000..5a2c9a01
--- /dev/null
+++ b/system/wayland/wayland-client-helper.c
@@ -0,0 +1,96 @@
+#include "wayland-client-helper.h"
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/socket.h>
+#include <sys/un.h>
+#include <unistd.h>
+
+#include "security-context-v1-protocol.h"
+#include <wayland-client.h>
+
+static void registry_handle_global(void *data, struct wl_registry *registry,
+                                   uint32_t name, const char *interface,
+                                   uint32_t version) {
+  struct wp_security_context_manager_v1 **out = data;
+
+  if (strcmp(interface, wp_security_context_manager_v1_interface.name) == 0)
+    *out = wl_registry_bind(registry, name,
+                            &wp_security_context_manager_v1_interface, 1);
+}
+
+static void registry_handle_global_remove(void *data,
+                                          struct wl_registry *registry,
+                                          uint32_t name) {} /* no-op */
+
+static const struct wl_registry_listener registry_listener = {
+    .global = registry_handle_global,
+    .global_remove = registry_handle_global_remove,
+};
+
+int32_t hakurei_bind_wayland_fd(char *socket_path, int fd, const char *app_id,
+                                const char *instance_id, int sync_fd) {
+  int32_t res = 0; /* refer to resErr for corresponding Go error */
+
+  struct wl_display *display;
+  display = wl_display_connect_to_fd(fd);
+  if (!display) {
+    res = 1;
+    goto out;
+  };
+
+  struct wl_registry *registry;
+  registry = wl_display_get_registry(display);
+
+  struct wp_security_context_manager_v1 *security_context_manager = NULL;
+  wl_registry_add_listener(registry, &registry_listener,
+                           &security_context_manager);
+  int ret;
+  ret = wl_display_roundtrip(display);
+  wl_registry_destroy(registry);
+  if (ret < 0)
+    goto out;
+
+  if (!security_context_manager) {
+    res = 2;
+    goto out;
+  }
+
+  int listen_fd = -1;
+  listen_fd = socket(AF_UNIX, SOCK_STREAM, 0);
+  if (listen_fd < 0)
+    goto out;
+
+  struct sockaddr_un sockaddr = {0};
+  sockaddr.sun_family = AF_UNIX;
+  snprintf(sockaddr.sun_path, sizeof(sockaddr.sun_path), "%s", socket_path);
+  if (bind(listen_fd, (struct sockaddr *)&sockaddr, sizeof(sockaddr)) != 0)
+    goto out;
+
+  if (listen(listen_fd, 0) != 0)
+    goto out;
+
+  struct wp_security_context_v1 *security_context;
+  security_context = wp_security_context_manager_v1_create_listener(
+      security_context_manager, listen_fd, sync_fd);
+  wp_security_context_v1_set_sandbox_engine(security_context, "app.hakurei");
+  wp_security_context_v1_set_app_id(security_context, app_id);
+  wp_security_context_v1_set_instance_id(security_context, instance_id);
+  wp_security_context_v1_commit(security_context);
+  wp_security_context_v1_destroy(security_context);
+  if (wl_display_roundtrip(display) < 0)
+    goto out;
+
+out:
+  if (listen_fd >= 0)
+    close(listen_fd);
+  if (security_context_manager)
+    wp_security_context_manager_v1_destroy(security_context_manager);
+  if (display)
+    wl_display_disconnect(display);
+
+  free((void *)socket_path);
+  free((void *)app_id);
+  free((void *)instance_id);
+  return res;
+}
diff --git a/system/wayland/wayland-client-helper.h b/system/wayland/wayland-client-helper.h
new file mode 100644
index 00000000..eae8936d
--- /dev/null
+++ b/system/wayland/wayland-client-helper.h
@@ -0,0 +1,4 @@
+#include <stdint.h>
+
+int32_t hakurei_bind_wayland_fd(char *socket_path, int fd, const char *app_id,
+                                const char *instance_id, int sync_fd);
\ No newline at end of file
diff --git a/system/wayland/wayland.go b/system/wayland/wayland.go
new file mode 100644
index 00000000..2aa1fe15
--- /dev/null
+++ b/system/wayland/wayland.go
@@ -0,0 +1,36 @@
+package wayland
+
+//go:generate sh -c "wayland-scanner client-header `pkg-config --variable=datarootdir wayland-protocols`/wayland-protocols/staging/security-context/security-context-v1.xml security-context-v1-protocol.h"
+//go:generate sh -c "wayland-scanner private-code `pkg-config --variable=datarootdir wayland-protocols`/wayland-protocols/staging/security-context/security-context-v1.xml security-context-v1-protocol.c"
+
+/*
+#cgo linux pkg-config: --static wayland-client
+#cgo freebsd openbsd LDFLAGS: -lwayland-client
+
+#include "wayland-client-helper.h"
+*/
+import "C"
+import (
+	"errors"
+	"strings"
+)
+
+var (
+	ErrContainsNull = errors.New("string contains null character")
+)
+
+var resErr = [...]error{
+	0: nil,
+	1: errors.New("wl_display_connect_to_fd() failed"),
+	2: errors.New("wp_security_context_v1 not available"),
+}
+
+func bindWaylandFd(socketPath string, fd uintptr, appID, instanceID string, syncFd uintptr) error {
+	if hasNull(appID) || hasNull(instanceID) {
+		return ErrContainsNull
+	}
+	res := C.hakurei_bind_wayland_fd(C.CString(socketPath), C.int(fd), C.CString(appID), C.CString(instanceID), C.int(syncFd))
+	return resErr[int32(res)]
+}
+
+func hasNull(s string) bool { return strings.IndexByte(s, '\x00') > -1 }