On Mon, 2008-10-27 at 15:51 -0400, seth vidal wrote:
We have a number of applications that end of listening on random
ports.
At which point the system is vulnerable (or sometimes just the user) is
vulnerable to whatever those daemons are vulnerable to.
The solution here would be to confine these daemons with SELinux, e.g.
the httpd process started by gnome-user-share would be confined to only
reading from ~/Public (and writing to ~/Public/Drop Box). Of course,
things like Rhythmbox would need to be split into two bits since we
generally can't confine GTK+ applications.
(Also, it's funny you write "just the user". Remember that on a typical
desktop system, the only high value targets are in $HOME with most of
them in $HOME/.mozilla.)
If the process needs to be able to listen on an external port then
that
needs to be enabled separately. You don't just turn off all the rules as
a solution.
However, I'd argue that people end up doing this anyway. That is, the
20% of the people that didn't give up figuring out how to do this.
David