-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 12/07/2012 04:59 PM, Rob Townley wrote:
> Daniel,
>
> Can the Firefox profile file hierarchy be sandboxed? So everything
> downloaded within the profile cache is sandboxed. More like if any
> application accesses something in a particular folder, sandboxing
> automatically kicks in.
>
You would need to setup something separately to do this. Sandboxing tool is
by user choice. For example in firefox/thunderbird I can specify that any
time it downloads content, firefox/thunderbird will run a command to view that
content. rather then use evince or ooffice, I have them run sandboxevince and
sandboxooffice, which are simple shell scripts wrapping sandbox command.
cat ~/bin/sandboxevince
#!/bin/sh
/usr/bin/sandbox -X /usr/bin/evince "$@"
cat ~/bin/sandboxooffice
#!/bin/sh
/usr/bin/sandbox -w 1400x750 -X ooffice "$@"
You can run your entire firefox session within a sandbox. Here is how I do this.
cat ~/bin/sandboxfirefox
sandbox -i ~/.mozilla -X -t sandbox_web_t -W metacity -w 1000x900 firefox $*
Now getting apps to run sandbox when looking at certain content is something
you would need to figure out.
> On Fri, Dec 7, 2012 at 5:49 AM, Daniel J Walsh <dwalsh@xxxxxxxxxx> wrote:
>
> On 12/06/2012 09:05 PM, David McGuffey wrote:
>>>> Moat of the advanced persistent threats (APT) are initiated via
>>>> e-mail. Opening an attachment or clicking on a web link starts the
>>>> process.
>>>>
>>>> Why isn't Firefox and Evolution confined with SELinux policy in a
>>>> way
> that
>>>> APT can't damage the rest of the system? Why are we not sandboxing
>>>> these two apps with SELinux?
>>>>
>>>> I've discovered some guidance for sandboxing Firefox using the
>>>> 'sandbox' command. Once I test it a bit, I'll post the results back
>>>> here. Seems
> to
>>>> me that if this works, it should be the default.
>>>>
>>>> DaveM
>>>>
>>>>
>>>> _______________________________________________ CentOS mailing list
>>>> CentOS@xxxxxxxxxx http://lists.centos.org/mailman/listinfo/centos
>>>>
> Very difficult to sandbox thunderbird and firefox. But sandbox tool
> actually works well for sandboxing viewers of downloaded data. I sandbox
> all content that will be viewed by evince and libreoffice.
>> _______________________________________________ CentOS mailing list
>> CentOS@xxxxxxxxxx http://lists.centos.org/mailman/listinfo/centos
>>
> _______________________________________________ CentOS mailing list
> CentOS@xxxxxxxxxx http://lists.centos.org/mailman/listinfo/centos
>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with undefined - http://www.enigmail.net/
iEYEARECAAYFAlDGAdcACgkQrlYvE4MpobNnTACgotqePhY2NY03GEZitDU2job7
Ia0An3YijmST+kuUxxLDPRsBhTzmEM0c
=k1X2
-----END PGP SIGNATURE-----
_______________________________________________
CentOS mailing list
CentOS@xxxxxxxxxx
http://lists.centos.org/mailman/listinfo/centos
