The Linux Security Circus: On GUI isolation

Re:The Linux Security Circus: On GUI isolation by bm98 on Thursday April 17, 2014 @09:18PM (#7607502)

The very first comment below the article (correctly) contradicts the author's claims about SELINUX sandbox. The author acknowledges the comment, and criticizes the SELINUX implementation, but does not dispute the fact that SELINUX sandbox ("sandbox -X xterm" in RHEL/CentOS/Fedora/SL) does in fact defeat the keystroke logger attack described in the article.

[ Parent | on HN ]

Re:The Linux Security Circus: On GUI isolation by reidrac on Friday April 18, 2014 @02:36AM (#7608179)

I would be nice if the article was amended to acknowledge the fact that a SELinux sandbox actually avoids "the problem".

I'm being confused with the "you will likely need to install it first: yum install xorg-x11-apps"; which means you need extra privileges before implementing the attack "as normal user!".

I guess the problem is not local access but a malicious app perhaps, but then it doesn't matter too much anyway because there are other ways of compromising the system.

[ Parent | on HN ]

Re:The Linux Security Circus: On GUI isolation by koios on Friday April 18, 2014 @06:31AM (#7608674)

The yum install xorg-x11-apps bit is so you can use the xinput tool as a demonstration of the problem. Fedora doesn't have it by default apparently so you need to install it.

A malicious app could just directly use the X protocol, no need to call this app, so unfortunately no additional privileges are needed.

[ Parent | on HN ]

Re:The Linux Security Circus: On GUI isolation by puzzlingcaptcha on Friday April 18, 2014 @07:35AM (#7608803)

Apparently you don't need to execute it with elevated privileges so you can build it (or your own variant) statically on a different machine for all you care.

[ Parent | on HN ]

Re:The Linux Security Circus: On GUI isolation by xenophonf on Friday April 18, 2014 @07:43AM (#7608820)

"I guess the problem is not local access but a malicious app perhaps, but then it doesn't matter too much anyway because there are other ways of compromising the system."

Well, that's the idea - protect a user from malicious apps running within their security context. Qubes does this by running apps within their own virtual machines.

[ Parent | on HN ]

Re:The Linux Security Circus: On GUI isolation by chris_wot on Friday April 18, 2014 @12:28PM (#7609833)

What did she mean by "The primary problem with SELinux sandbox is that it still relies on the big, buggy, bloated Linux kernel to enforce security."

Genuinely curious.

[ Parent | on HN ]