Project

General

Profile

Bug #11579

Research what to do wrt. D-Bus activatable apps and AppArmor

Added by intrigeri about 3 years ago. Updated 6 months ago.

Status:
Confirmed
Priority:
Normal
Assignee:
-
Category:
-
Target version:
-
Start date:
07/19/2016
Due date:
% Done:

0%

Feature Branch:
Type of work:
Security Audit
Blueprint:
Starter:
Affected tool:
Browser

Description

As we found out in #10836#note-9, unfiltered access to the session D-Bus bus allows a confined application to have the session's dbus-daemon execute any D-Bus activatable app. The executed application will run under its own AppArmor profile, if it has one, and unconfined otherwise. In Tails 2.4, the D-Bus activatable applications we ship are: Totem, Nautilus, Screenshot, PortalHelper and gedit.

So the next question is: is it acceptable? How can an attacker, who controls Tor Browser, leverage this to do stuff they should be forbidden to? Shall we make all apps non-D-Bus-activatable?

While researching all these questions, let's keep in mind that to get working input systems and accessibility support, we need to give Tor Browser access to the session bus anyway (and unfiltered access until the kernel patches needed to filter D-Bus calls make it into mainline Linux).


Related issues

Related to Tails - Bug #10836: Investigate why the Tor Browser AppArmor profile allows starting Totem Resolved 01/02/2016
Related to Tails - Feature #12213: Wayland in Tails 5.0 (Bullseye) In Progress 09/02/2017

History

#1 Updated by intrigeri about 3 years ago

  • Related to Bug #10836: Investigate why the Tor Browser AppArmor profile allows starting Totem added

#2 Updated by intrigeri 6 months ago

#3 Updated by intrigeri 6 months ago

  • Assignee deleted (intrigeri)

Also available in: Atom PDF