<div dir="ltr"><br><br><div class="gmail_quote">On Fri, Aug 1, 2008 at 4:01 PM, C. Scott Ananian <span dir="ltr"><<a href="mailto:cscott@laptop.org">cscott@laptop.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div class="Ih2E3d">On Fri, Aug 1, 2008 at 5:01 PM, Jameson Chema Quinn<br>
<<a href="mailto:jquinn@cs.oberlin.edu">jquinn@cs.oberlin.edu</a>> wrote:<br>
> Problem: anything named "Journal", "Terminal", "Log", or "Analyze" is not<br>
> isolated. This is the biggest security hole we have right now: it is a<br>
> trivial way for any activity to get root access.<br>
<br>
</div>Another possible short-term hack is to simple disable<br>
activitybundle.install() and activitybundle.upgrade() for bundes with<br>
bundle_ids matching those of Journal, Terminal, Log, or Analyze. This<br>
allows these activities to be installed in /home/olpc/Activites with a<br>
customization key, as usual, but prevents malicious attackers from<br>
using a web link or the activity updater to replace the<br>
originally-installed versions.<br>
<br>
This has the benefit of (a) not requiring us to revisit the<br>
"activities in /home" war, and (b) allowing us to upgrade the versions<br>
of these trusted activities in /home in (say) 9.1, using the "proper"<br>
mechanism.<br>
--scott<br>
<font color="#888888"></font></blockquote><div><br>I like this idea. Of course, it means that can install using "cp -r", including installing a trojan activity which does not *look* like Terminal.<br><br>... My patch has activities requesting P_ROOT in <a href="http://activity.info">activity.info</a>. Could we simply refuse to do a normal install for such activities? We could even keep a list of them, and not respect what's not on the list, and only update the list on a keyed install. This is not as secure as signatures, because a sneaky attack could still modify the contents of an installed activity, but it is getting pretty close.<br>
<br>Jameson<br> </div></div><br></div>