Re: gnome-panel menu lockdown proposal

[Ghee Teo <Ghee Teo Sun COM>]

There is another type of gocha type of against lock down.
Some dialog allows you to specify the command that you want to run (exec)
So user can simply change that to something like gnome-terminal and
hence open up a hole in the intended lockdown.

An example in point is http://bugzilla.gnome.org/show_bug.cgi?id=394560
One  way to lock this down is to remove the applet in point from
the Add to panel list, and that will requires special point patch
or not to install that package completely.

-Ghee

guenther wrote:
> On Mon, 2007-01-08 at 19:18 +0100, Vincent Untz wrote:
>   
> > Le lundi 08 janvier 2007, �6:07, guenther a �it :
> >     
> > > > > * deskbar-applet
> > > > >           
> > > > Just disallow use of the deskbar-applet completely, via disabled_applets.
> > > >         
> > > So there is a third part involved the admin needs to take care of in
> > > order to lock down anything...
> > >       
> > We can make things easier with pessulus: if this lockdown setting is
> > enabled, then we can also automatically add deskbar-applet to
> > disabled_applets.
> >     
>
> Yup...
>
> However, my main goal remains: I want to raise hacker's and admin's
> awareness of this issue. There are lots of ways to escape this
> limitation, which should be addressed to seriously lock down as
> advertised. Admins need to understand this might not be as complete as
> expected and the name promises.
>
>   guenther
>
>
>