Ivan Gyurdiev wrote:
That is not entirely true. java, wine and mono all run in their own domain in targeted which is unconfined. I could do similar for thunderbird, firefox and freinds. We are not trying to confine these apps, but trying to confine the exec* apps to as few as possible.Moz/ffox/tbird cannot be moved into their own domain until we have the capability to launch content handling applications from within firefox, and have them enter the proper domain. This is particularly difficult, because some of those applications (i.e. openoffice) don't have a domain at the moment (and creating one would be difficult). That means firefox must be allowed to transition into user_t/unconfined_t, which defeats any attempt at security. Launching one application within another is the primary reason why the desktop can't be confined.If we cannot move the moz/ffox/tbird into their own domain then, yes, disable the checks for unconfined processes. But we should keep the tests for all programs which have their own domain.
In the old strict policy firefox and mozilla were confined, and I worked on the evolution and thunderbird policies over the summer. I think the basic functionality was working, but those programs could not be allowed to launch other apps. We need a trusted program to be responsible for that, so that firefox can't transition into the generic domain.There's other problems as well, including limiting those programs' ability to write to the user home directory, and the top level /tmp directory (what good does confining an application do, if it can still overwrite all your important files, or steal your credit card info?). There's marking of content as potentially hostile, and management of that content.There's an effort to limit bonobo connections from firefox to restricted domains only (no user_t/unconfined_t connections).... also challenging, because there's so many things firefox talks to, and one of them is sufficient to necessitate allowing communications channel to user_t/unconfined_t.=============Currently the firefox/moz/tbird/evolution policies have not been ported yet to the new refpolicy. They also require the policies for bonobo, orbit, gnome and other dekstop-related things (also not yet ported). Even when they are ported, I doubt they would meet the needs of targeted-policy users.