On Tue, 2007-05-15 at 14:44 -0400, Daniel J Walsh wrote:
> Supposedly The SELinux XExtensions are in FC7 and beyond so time to
> start using them.
>
> But lets start simple ...
>
> Some of you are looking at using Trusted X for MLS, but I want to look
> at this from a targeted policy point of view. What are the security
> goals of a normal Fedora user.
>
> Lets establish two tangible goals.
>
> 1. Only the application with focus can get keyboard input. So if I am
> on a web page that is asking me for a password (On Line Banking) Only
> Firefox can read the input. Not Thunderbird.
> Theoretically I could run this with all apps mostly unconfined.
> firefox_t can capture input on firefox_t. While unconfined_t can not.

 This might go well, I'm not sure, and if it does would be a big plus :)

> 2. No apps except gimp can do a screen capture. Again I want all apps
> mostly unconfined
> My goal is to get a policy that prevents any app from screen capture
> including
> unconfined_t. Bug gimp_t in the unconfined domain can.

 You will need to include gnome-screenshot as well as gimp here though, or a lot of people will complain (PrintScreen). With those two, this might be able to work (None of the gnome-screensaver actions try to take shots now, IIRC).

-- 
James Antill <jantill@redhat.com>




--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.



application/pgp-signature attachment: This is a digitally signed message part