Re: [gentoo-soc] Weekly Report: Fusebox - FUSE Porwered sandbox project

[Kaoru Esashika]

Hi, Thank you for your advice and for reviewing my code, EBo.

I agree with your advice, the whitelist method is good practice.
In my current code, the default security model is the whitelist method.
However, in the test code, I change it to the blacklist method for convenience.
So I guess you might misunderstand.

Because the behavior of ACL should be maintained to Gentoo's sandbox,
this behavior might be changed for the future.
Anyway, thank you for your advice. I'll keep your advice in mind.

On Mon, Jul 27, 2020 at 1:48 PM EBo <ebo@×××××××.com> wrote:
>
> Recently I was watching some videos that was looking at vulnerabilities
> in IP camera systems and many of the fails that the security person was
> able to exploit were forgetting to lock down access to some directory or
> file so that he was able to first examine a program or script, and then
> determine points of access.  With the discussion here I was wondering if
> there was any mechanism to turn all access off, and then 'grant' access
> to something.  This may be similar to how Gentoo's USE flags can be
> likewise cleaned by:  "USE = "-* X alsa..."
>
> Anyway, I browsed your tests and did not find anything and thought I
> might mention it.
>
>    EBo --
>
> On Jul 26 2020 5:00 PM, Kaoru Esashika wrote:
> > Hi,
> > This week, I wrote the code about ACL (Access Control List).
> > The ACL allows you to actually control whether or not the application
> > can access your files.
> > This implementation also includes an interface that allows you to
> > control access to the files dynamically.
> > Specifically, you can control access to specific files by writing a
> > list of files to be controlled in a special virtual file called a
> > control file.
> >
> > Next week, I will integrate the Fusebox with emerge/portage. And
> > also,
> > I need prepare to evaluation...
> >
> > Project Repository: https://github.com/pluser/fusebox
> >
> > Regards,
> > Kaoru Esashika
>
>