On Thu, 2015-05-21 at 21:03 -0400, Frank Ch. Eigler wrote:
Jason L Tibbitts III <tibbs(a)math.uh.edu> writes:
> Here are the recent changes to the packaging guidelines:
> * https://fedoraproject.org/wiki/Packaging:DefaultServices
In this context (1.1 "locally running services"), what is a "public
network socket"? Is the idea that localhost services are now
permitted by default (despite the risk of e.g. privilege escalation
that we had tried to preclude before)?
The definition of "public" was intentionally vague, but perhaps we
could try to find a better way to say it. I was trying to treat it as
"network interfaces that accept connections from arbitrary sources".
I'm not sure that there's a tremendously meaningful distinction to be
made between allowing services that listen on D-BUS or a local UNIX
socket and services that listen on the localhost TCP socket, except
perhaps that D-BUS and UNIX sockets have a limited degree of built-in
I'd personally prefer to assume the best intentions of our packagers;
specifically I'd assume that if there's a question as to the safety of
starting something by default, either they'd bring it up voluntarily or
someone would do so on their behalf if a problem was discovered.