Re: Thank you, unknown genius!

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Les Mikesell wrote:
Bruno Wolff III wrote:

Bruno is noting that the current methods of exploitation tend to be web
pages, flash, java, media files and a firewall isn't going to be of much help with this type of intrusion but selinux clearly could be a layer of
use here.
Does it actually prevent browser plugins from doing things that the running user can't do in the default configuration?

Yes.

I thought plugins ran as libraries within the same process. SELinux can prevent them from loading which isn't particularly useful. How can it control separately what a plugin can do without breaking the browser's own ability to it?

I already gave you the link earlier. Nspluginwrapper is installed by default which can run plugins in a separate memory address making it possible to confine it by policy. If a flash plugin tries to access files under .ssh for example, SELinux policy can prevent that as a obvious violation.

Rahul


[Index of Archives]     [Current Fedora Users]     [Fedora Desktop]     [Fedora SELinux]     [Yosemite News]     [Yosemite Photos]     [KDE Users]     [Fedora Tools]     [Fedora Docs]

  Powered by Linux