<div dir="ltr"><br><br><div class="gmail_quote">On Fri, Aug 1, 2008 at 4:01 PM, C. Scott Ananian <span dir="ltr"><<a href="mailto:cscott@laptop.org">cscott@laptop.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"> <div class="Ih2E3d">On Fri, Aug 1, 2008 at 5:01 PM, Jameson Chema Quinn<br> <<a href="mailto:jquinn@cs.oberlin.edu">jquinn@cs.oberlin.edu</a>> wrote:<br> > Problem: anything named "Journal", "Terminal", "Log", or "Analyze" is not<br> > isolated. This is the biggest security hole we have right now: it is a<br> > trivial way for any activity to get root access.<br> <br> </div>Another possible short-term hack is to simple disable<br> activitybundle.install() and activitybundle.upgrade() for bundes with<br> bundle_ids matching those of Journal, Terminal, Log, or Analyze.  This<br> allows these activities to be installed in /home/olpc/Activites with a<br> customization key, as usual, but prevents malicious attackers from<br> using a web link or the activity updater to replace the<br> originally-installed versions.<br> <br> This has the benefit of (a) not requiring us to revisit the<br> "activities in /home" war, and (b) allowing us to upgrade the versions<br> of these trusted activities in /home in (say) 9.1, using the "proper"<br> mechanism.<br>  --scott<br> <font color="#888888"></font></blockquote><div><br>I like this idea. Of course, it means that can install using "cp -r", including installing a trojan activity which does not *look* like Terminal.<br><br>... My patch has activities requesting P_ROOT in <a href="http://activity.info">activity.info</a>. Could we simply refuse to do a normal install for such activities? We could even keep a list of them, and not respect what's not on the list, and only update the list on a keyed install. This is not as secure as signatures, because a sneaky attack could still modify the contents of an installed activity, but it is getting pretty close.<br> <br>Jameson<br> </div></div><br></div>