Following is the list of topics that will be discussed in the FESCo
meeting today at 17:00UTC (1:00pm EST, 19:00 CEST) in #fedora-meeting on
Links to all tickets below can be found at:
= Followups =
#topic #699 Proposal to remove the package "tzdata" from Critical Path
#830 F18 Feature: ARM as Primary Arch --
= New business =
#829 New sponsor request: Pavel Alexeev (hubbitus)
= Open Floor =
For more complete details, please visit each individual ticket. The
report of the agenda items can be found at
If you would like to add something to this agenda, you can reply to
this e-mail, file a new ticket at https://fedorahosted.org/fesco,
e-mail me directly, or bring it up at the end of the meeting, during
the open floor topic. Note that added topics may be deferred until
the following meeting.
Hi, folks! Just wanted to remind everyone that along with Beta testing,
it's Test Day time again today:
We'll be looking at power management. This is a regular Test Day so it
should go off nice and smoothly, and of course it's of interest to most
everyone with a laptop. If you get a minute around Beta testing, please
drop by #fedora-test-day and help out! There are of course full
instructions and test cases on the wiki page. Thanks everyone!
Fedora QA Community Monkey
IRC: adamw | Twitter: AdamW_Fedora | identi.ca: adamwfedora
test-announce mailing list
On Tue, Apr 3, 2012 at 5:47 PM, Bryn M. Reeves <bmr(a)redhat.com> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> On 04/03/2012 08:10 AM, Joel Rees wrote:
>> On Tue, Apr 3, 2012 at 3:27 PM, Tim <ignored_mailbox(a)yahoo.com.au>
>> wrote: s/some/a lot of/
>> if you set it up right.
> It can still do a fair amount of nasty stuff.
>> "xhost local:<subuser-id>; sudo -u <subuser-id>" does pretty well
>> with current applications.
> You're allowing the local sandbox user to connect to the local X
> server so any process running in one of your sandboxes can start a
> connection to X and start looking for vulnerabilities to exploit.
Of which X11 still has its share, we are told.
Humor me. Does running firefox this way, as a different user on the
same machine, increase risks, as compared to running firefox as the
user you are logged in as? If so, how?
> Due to the elevated privilege with which X runs this could include
> privilege escalations.
Okay, so why doesn't Fedora drop privileges on Xorg like a certain BSD does?
> There have been vulnerabilities of this kind in
> the past that allowed an attacker to quickly gain a root shell given
> the ability to connect to the X server.
Well, sure. That's going to happen when you run a server as root.
But does it open holes to run the application accessing X as a
different user? ergo, holes that wouldn't be open when running the
same application as the user you logged in as?
>> Now, if I'm going to my bank site, I do log out and log in as a
>> different user, just to be extra safe.
Now, I want to make it clear that I recognize that, if the bad guys
have succeeded in taking over the bank site, restricting my internet
banking access to an account that I do nothing else with doesn't
protect me, relative to that bank. It may keep up some speed bumps and
low walls relative to attacks on my machine, of course.
> I think you'd be better off taking a look at Daniel Walsh's blog posts
> on confining X applications with the SELinux sandbox. The first post
> introduces and explains the general sandbox concept:
I am familiar with the sandbox principle, in several versions, thank
you. Not that one more point of view or version ever hurt.
This blog could help me figure out SELinux's ACL tools, which, if I
continue to use Fedora, it looks like I'll have to learn to use.
In self-defense, if for no other reason.
> And the follow up looks at extending this to untrusted X applications
> using a temporary xguest account (with dynamic $HOME and $TMP) and the
> Xephyr X-on-X server to provide much stronger separation between the
> sandbox and the rest of the system:
I notice that he is using mount-over tricks to augment the
protections. Fancy or funky? I'll have to re-read that when I have
> Fedora already provides contexts to use with the sandbox such as
> sandbox_x_t, sandbox_web_t, sandbox_net_t etc. depending on the
> particular resources you want to allow the sandbox to access.
You know, one of the problems with ACLs (and capabilities) is getting
them set up right. And you know how it ends up?
Well, as you say, and as Walsh acknowledges,
> The post discusses future improvements to simplify retrieving files
> from the sandbox when the application exits but I'm not sure of the
> current status of that work.
I've been trying to avoid what I'm sure amounts to blasphemy in the
eyes of some on these lists, but I am not particularly fond of
SELinux. Way too many convolutions to hide bugs in. If X11 must be
assumed to have bugs, so much more, the more recent and more
complicated SELinux, especially in the patterns by which the tools to
set policy are run.
I'm going to prefer to trust tools I can understand.
On Sat, Mar 31, 2012 at 7:04 PM, Tim <ignored_mailbox(a)yahoo.com.au> wrote:
> On Fri, 2012-03-30 at 20:39 +0100, James Wilkinson wrote:
>> From there, it follows that the easiest way to do this is to make 002
>> the default umask, which means that all new files and directories
>> created by normal users have these permissions. That means that if you
>> want files that only their owner can write to, you need a per-user
> It always struck me that personal files ought to have no group or world
> permissions set by default. If you wanted your files to have those
> extra permission set, then it ought to be done as a deliberate choice.
Maybe "user-id" is mis-named. There are sure a lot of people who tend
to see "user-id" and expect the one-to-one correspondence. I know the
conflation caused me some frustration back in college, and I'm not
sure I got it properly worked out until I put together a few openbsd
Anyway, it should be clear that a system administrator should not be
logged in as a system administrator when he or she is just writing an
e-mail scheduling meetings or something. But even ordinary (human)
users should not be surfing the web as the user they logged in as, and
I'm not talking about keeping my boss from checking my cache for
visits to slashdot or whatever.
As the system administrator for my home box, I want to be able to log
in as a normal user that is not tainted by my the web sites I visited
last time I logged in. That means I have a separate administrator
I want one user-id/group-id pair for each bank I have to visit, so
that, even if we can't get the banks to use special-purpose browsers
for the money transactions, I can protect the bank data from the guys
that want to mine my data for their gain, including the other banks.
(Special purpose browsers are preferred, of course.)
And when I need to go surfing through blogs for news, I don't want to
do that with the user I logged in as. Even if/when we can get rid of
the sloppy programming practices Microsoft and their ilk promote, we
can't be sure we have every hole plugged, so it's just going to be
safer to do that as a user that isn't allowed to log in. That means
that, even though I log out of my "worker" user and log back in as my
"play" user, I still want to spawn a nologin user from there to surf.
(This is not pure paranoia. I checked out a company for a job and
discovered that Google had flagged their site as containing malware,
and the guy who ran the company did not have the financial means or
motivation to hire someone to clean the server up. Scared of having to
move off the vulnerable tools he was using, trying to meet a market
window that was fast disappearing, all the excuses.)
Incidentally, I'm doing this much now, using xhost local and sudo. (If
is my blog from when I first got it running. I need to re-write that
explanation, which is part of the reason I'm writing this long-winded
post now. But I still have issues with the input method that I need to
solve. And I need to write some scripts so I don't have to all the
tweaks by hand every time.)
And I glue it together with per-user groups. Without per-user groups,
I would have to go through serious admin-level contortions to grab a
download. Does that make sense?