| 1 |
You are welcome. I understand the utility and usefulness of both he |
| 2 |
white and black lists. Maybe you can add 2 tests which tests that the |
| 3 |
white/black listing respect the boundary. It will also show that you |
| 4 |
can go either way, and them maybe in the docs suggest which might be |
| 5 |
preferred in what circumstance. |
| 6 |
|
| 7 |
HHHhhhh... As a further note. Many projects and groups are moving away |
| 8 |
from what some consider racially charged terminology -- and if I am not |
| 9 |
mistaken white/black lists may be one of them. Can you check and make |
| 10 |
sure what the current acceptable terminology is and we all might want to |
| 11 |
get into the habit using them. |
| 12 |
|
| 13 |
On Jul 28 2020 2:08 PM, Kaoru Esashika wrote: |
| 14 |
> Hi, Thank you for your advice and for reviewing my code, EBo. |
| 15 |
> |
| 16 |
> I agree with your advice, the whitelist method is good practice. |
| 17 |
> In my current code, the default security model is the whitelist |
| 18 |
> method. |
| 19 |
> However, in the test code, I change it to the blacklist method for |
| 20 |
> convenience. |
| 21 |
> So I guess you might misunderstand. |
| 22 |
> |
| 23 |
> Because the behavior of ACL should be maintained to Gentoo's sandbox, |
| 24 |
> this behavior might be changed for the future. |
| 25 |
> Anyway, thank you for your advice. I'll keep your advice in mind. |
| 26 |
> |
| 27 |
> On Mon, Jul 27, 2020 at 1:48 PM EBo <ebo@×××××××.com> wrote: |
| 28 |
>> |
| 29 |
>> Recently I was watching some videos that was looking at |
| 30 |
>> vulnerabilities |
| 31 |
>> in IP camera systems and many of the fails that the security person |
| 32 |
>> was |
| 33 |
>> able to exploit were forgetting to lock down access to some |
| 34 |
>> directory or |
| 35 |
>> file so that he was able to first examine a program or script, and |
| 36 |
>> then |
| 37 |
>> determine points of access. With the discussion here I was |
| 38 |
>> wondering if |
| 39 |
>> there was any mechanism to turn all access off, and then 'grant' |
| 40 |
>> access |
| 41 |
>> to something. This may be similar to how Gentoo's USE flags can be |
| 42 |
>> likewise cleaned by: "USE = "-* X alsa..." |
| 43 |
>> |
| 44 |
>> Anyway, I browsed your tests and did not find anything and thought I |
| 45 |
>> might mention it. |
| 46 |
>> |
| 47 |
>> EBo -- |
| 48 |
>> |
| 49 |
>> On Jul 26 2020 5:00 PM, Kaoru Esashika wrote: |
| 50 |
>> > Hi, |
| 51 |
>> > This week, I wrote the code about ACL (Access Control List). |
| 52 |
>> > The ACL allows you to actually control whether or not the |
| 53 |
>> application |
| 54 |
>> > can access your files. |
| 55 |
>> > This implementation also includes an interface that allows you to |
| 56 |
>> > control access to the files dynamically. |
| 57 |
>> > Specifically, you can control access to specific files by writing |
| 58 |
>> a |
| 59 |
>> > list of files to be controlled in a special virtual file called a |
| 60 |
>> > control file. |
| 61 |
>> > |
| 62 |
>> > Next week, I will integrate the Fusebox with emerge/portage. And |
| 63 |
>> > also, |
| 64 |
>> > I need prepare to evaluation... |
| 65 |
>> > |
| 66 |
>> > Project Repository: https://github.com/pluser/fusebox |
| 67 |
>> > |
| 68 |
>> > Regards, |
| 69 |
>> > Kaoru Esashika |
| 70 |
>> |
| 71 |
>> |
Archives