On Mon, 2008-10-27 at 15:51 -0400, seth vidal wrote:
> We have a number of applications that end of listening on random ports.
> At which point the system is vulnerable (or sometimes just the user) is
> vulnerable to whatever those daemons are vulnerable to.
The solution here would be to confine these daemons with SELinux, e.g.
the httpd process started by gnome-user-share would be confined to only
reading from ~/Public (and writing to ~/Public/Drop Box). Of course,
things like Rhythmbox would need to be split into two bits since we
generally can't confine GTK+ applications.
(Also, it's funny you write "just the user". Remember that on a typical
desktop system, the only high value targets are in $HOME with most of
them in $HOME/.mozilla.)
> If the process needs to be able to listen on an external port then that
> needs to be enabled separately. You don't just turn off all the rules as
> a solution.
However, I'd argue that people end up doing this anyway. That is, the
20% of the people that didn't give up figuring out how to do this.
David
--
Fedora-desktop-list mailing list
Fedora-desktop-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/fedora-desktop-list
