From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id E11FA138359 for ; Tue, 28 Jul 2020 20:24:46 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 1BFE2E0CB6; Tue, 28 Jul 2020 20:24:46 +0000 (UTC) Received: from raba.swcp.com (raba.swcp.com [216.184.2.46]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id EDFB0E0CB6 for ; Tue, 28 Jul 2020 20:24:45 +0000 (UTC) Received: from roundcube.swcp.com (roundcube.swcp.com [216.184.2.221]) by raba.swcp.com (8.15.2/8.15.2/Debian-14~deb10u1) with ESMTP id 06SKOhHc002248 for ; Tue, 28 Jul 2020 14:24:44 -0600 Received: from roundcube.swcp.com (localhost [127.0.0.1]) by roundcube.swcp.com (8.15.2/8.15.2/Debian-8) with ESMTP id 06SKOhGJ031409 for ; Tue, 28 Jul 2020 14:24:43 -0600 Received: (from www-data@localhost) by roundcube.swcp.com (8.15.2/8.15.2/Submit) id 06SKOhhc031408; Tue, 28 Jul 2020 14:24:43 -0600 X-Authentication-Warning: roundcube.swcp.com: www-data set sender to ebo@sandien.com using -f To: Subject: Re: [gentoo-soc] Weekly Report: Fusebox - FUSE Porwered sandbox project X-PHP-Originating-Script: 1000:main.inc Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-soc@lists.gentoo.org Reply-to: gentoo-soc@lists.gentoo.org X-Auto-Response-Suppress: DR, RN, NRN, OOF, AutoReply MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Date: Tue, 28 Jul 2020 14:24:43 -0600 From: EBo In-Reply-To: References: <74bfe2205faccaf9bf07e0e4be0d8d73@mail.swcp.com> Message-ID: X-Sender: ebo@sandien.com User-Agent: Roundcube Webmail/0.8.2 X-Archives-Salt: f2611383-1ec6-468c-a036-9c017fe53ac5 X-Archives-Hash: 81ab5c8e708b76b29f71adf282e9a5ef You are welcome. I understand the utility and usefulness of both he white and black lists. Maybe you can add 2 tests which tests that the white/black listing respect the boundary. It will also show that you can go either way, and them maybe in the docs suggest which might be preferred in what circumstance. HHHhhhh... As a further note. Many projects and groups are moving away from what some consider racially charged terminology -- and if I am not mistaken white/black lists may be one of them. Can you check and make sure what the current acceptable terminology is and we all might want to get into the habit using them. On Jul 28 2020 2:08 PM, Kaoru Esashika wrote: > Hi, Thank you for your advice and for reviewing my code, EBo. > > I agree with your advice, the whitelist method is good practice. > In my current code, the default security model is the whitelist > method. > However, in the test code, I change it to the blacklist method for > convenience. > So I guess you might misunderstand. > > Because the behavior of ACL should be maintained to Gentoo's sandbox, > this behavior might be changed for the future. > Anyway, thank you for your advice. I'll keep your advice in mind. > > On Mon, Jul 27, 2020 at 1:48 PM EBo wrote: >> >> Recently I was watching some videos that was looking at >> vulnerabilities >> in IP camera systems and many of the fails that the security person >> was >> able to exploit were forgetting to lock down access to some >> directory or >> file so that he was able to first examine a program or script, and >> then >> determine points of access. With the discussion here I was >> wondering if >> there was any mechanism to turn all access off, and then 'grant' >> access >> to something. This may be similar to how Gentoo's USE flags can be >> likewise cleaned by: "USE = "-* X alsa..." >> >> Anyway, I browsed your tests and did not find anything and thought I >> might mention it. >> >> EBo -- >> >> On Jul 26 2020 5:00 PM, Kaoru Esashika wrote: >> > Hi, >> > This week, I wrote the code about ACL (Access Control List). >> > The ACL allows you to actually control whether or not the >> application >> > can access your files. >> > This implementation also includes an interface that allows you to >> > control access to the files dynamically. >> > Specifically, you can control access to specific files by writing >> a >> > list of files to be controlled in a special virtual file called a >> > control file. >> > >> > Next week, I will integrate the Fusebox with emerge/portage. And >> > also, >> > I need prepare to evaluation... >> > >> > Project Repository: https://github.com/pluser/fusebox >> > >> > Regards, >> > Kaoru Esashika >> >>