On Sat, Dec 17, 2016 at 12:22 AM, Michael Catanzaro <mcatanzaro(a)gnome.org>
wrote:
On Fri, 2016-12-16 at 12:18 -0500, Matthew Miller wrote:
> Can someone confirm that this update at least mitigates the issue
> highlighted in the blog?
The blog post indicates that it also targets the totem thumbnailer and
totem itself, so no, improving tracker is not sufficient here.
Michael
_______________________________________________
desktop mailing list -- desktop(a)lists.fedoraproject.org
To unsubscribe send an email to desktop-leave(a)lists.fedoraproject.org
wrt thumbnailers, I wanted to implement sandboxing for all of them using
bubblewrap, see here
https://bugzilla.gnome.org/show_bug.cgi?id=774497
but then I realized this will break thumbnailing support in flatpak'd
applications, so I didn't implement it.
We can try to use seccomp and such in every thumbnailers, but there are all
kinds of thumbnailers a user can install (and they all parse untrusted
files) so it sounds better if we implement some sort of a generic solution
to sandbox *all* thumbnailers, instead of plugging holes in individual
ones...
--
-Elad.