4 ms·
I would be nice if the article was amended to acknowledge the fact that a SELinux sandbox actually avoids "the problem". I'm being confused with the "you will
by reidrac 13y ago
I would be nice if the article was amended to acknowledge the fact that a SELinux sandbox actually avoids "the problem".
I'm being confused with the "you will likely need to install it first: yum install xorg-x11-apps"; which means you need extra privileges before implementing the attack "as normal user!".
I guess the problem is not local access but a malicious app perhaps, but then it doesn't matter too much anyway because there are other ways of compromising the system.
- koios 13y agoThe yum install xorg-x11-apps bit is so you can use the xinput tool as a demonstration of the problem. Fedora doesn't have it by default apparently so you need to install it. A malicious app could just directly use the X protocol, no need to call this app, so unfortunately no additional privileges are needed.
- puzzlingcaptcha 13y agoApparently you don't need to execute it with elevated privileges so you can build it (or your own variant) statically on a different machine for all you care.
- xenophonf 13y ago"I guess the problem is not local access but a malicious app perhaps, but then it doesn't matter too much anyway because there are other ways of compromising the system." Well, that's the idea - protect a user from malicious apps running within their security context. Qubes does this by running apps within their own virtual machines.
- chris_wot 13y agoWhat did she mean by "The primary problem with SELinux sandbox is that it still relies on the big, buggy, bloated Linux kernel to enforce security." Genuinely curious.