Changes between Version 52 and Version 53 of mmcco

Timestamp:

Jul 22, 2015, 4:59:55 AM (9 years ago)

Author:

mmcco

Comment:

Pidgin processes need continued access to /usr/share for GTK stuff, other related privsep fixes

mmcco

@@ -135 +135 @@
 Privilege separation is one of the easiest ways to improve Pidgin's security.
 
-Generally, there are only two types of file access for Pidgin/libpurple:
+After initial library loading, there are three types of file access for Pidgin:
 * access to libpurple-specific files in `~/.purple/`
 * access to files in arbitrary locations for file transfers
+* GTK-related files (icons, etc.) from `/usr/share`
 
-This makes the solution pretty clear: have a process for Pidgin's core that's chrooted to `~/.purple/` and a file transfer helper process with arbitrary file access.
+Of course, the third does not apply to libpurple.
 
-Later, additional daemons could be added for things like logging and chrooted to subdirectories of `~/.purple/`. This would further protect user credentials and OTR keys.
+This suggests a solution: we can have a process for Pidgin's core that's restricted to `~/.purple/` and `/usr/share`, and a file transfer helper process with arbitrary file access.
+
+Later, additional daemons could be added for things like logging and restricted to subdirectories of `~/.purple/`. This would further protect user credentials and OTR keys.
 
 === Breakages ===