3 ms·
Gnome-Keyring does not use the kernel keyring facility (correct me if I'm wrong). It also doesn't limit access in any way. Anyone who can connect to the keyrin
by lima 10y ago
Gnome-Keyring does not use the kernel keyring facility (correct me if I'm wrong).
It also doesn't limit access in any way. Anyone who can connect to the keyring socket gets access to everything. How is this better than storing it in files?
- sandGorgon 10y ago> Anyone who can connect to the keyring socket gets access to everything. How is this better than storing it in files? That is not something im personally qualified to answer. However, ypu should ask that question of selinux. Assuming something like selinux makes sense, and gnome-keyring is protected by selinux.. my point is to use builtin infrastructure.
- lima 10y agoWell, SELinux can differentiate between different subjects whereas gnome-keyring cannot. Fedora's default policy prevents openvpn from accessing your SSH keys.
- sandGorgon 10y agoYou are misunderstanding user screen fatigue. This [1] is the error message spit out by openvpn when it asks you to restorecon on your cert directory - https://bugzilla.gnome.org/show_bug.cgi?id=689818#c3 https://bugzilla.gnome.org/show_bug.cgi?id=689818#c3 It is NOT asking you to do some specific openvpn restricted setting. Its basically setting it to the same permission level as gnome-keyring. Except - not even password protected. And the biggest issue - obviously an end-user has to muck about this stuff.
- lima 10y agoYou're misunderstand what SELinux does with OpenVPN. OpenVPN runs confined, so the only thing it's allowed to access in your profile directory is the certificate files. The OpenVPN SELinux policy says "OpenVPN may only access files marked home_cert_t". With gnome-keyring, it would have access to all your secrets.