Progress report: Lockdown and Deployment

["Sayamindu Dasgupta" <sayamindu gmail com>]

Hi all,

It's raining non stop outside for the last one and a half days, and
the city has come to a complete standstill [1]. That's actually good
news for me, since I do not have to go out now and then and work non
stop on my SoC :-).

After last week's report, I have finally managed to clean up the
Nautilus patch for global items (I'll post it on bugzilla once
Federico gives me the initial go ahead :-).

Moving on to the next stage of the SoC (restricted file system views),
I taught myself a bit of HAL, and figured out how to get a list of
removable storage devices attached to the system using HAL. However,
after that, I realized that someone had already implemented that for
me... in GNOME-VFS via gnome_vfs_volume_monitor_get_mounted_volumes()
and gnome_vfs_volume_is_user_visible() :-).


Right now, my plan for restricted file system view is something like:

1. List of allowed directories are stored in GConf key
/desktop/gnome/lockdown/allowed_dirs
2. gnome-settings-daemon reads this list and exports it via xsettings
3. nautilus uses gconf to read the list and allows access for users
while the gtk+ filechooser (using the GNOME-VFS backend) reads it from
xsettings
4. additionally both of the above use gnome-vfs to figure out
user-visible volumes and allow access to them since policy on those
are set by HAL anyway..

However, I have been wondering if it is a better idea to check for
allowed directories from within GNOME-VFS itself. A downside to this
might be that applications that may use gnome-vfs to read config
files/etc outside the set of allowed directories might break - but I'm
not sure whether apps do use gnome-vfs to access such files. The
advantage on the other hand would be that I do not have to fiddle
around with gnome-settings-daemon or xsettings, since the policies
would automatically be applicable for the gnome-vfs based backend of
the filechooser (I'm ignoring the unix backend).

I have already sent a mail to the Nautilus list asking for suggestions
on the above idea (the above part is actually a copy paste of that
mail).

Hopefully, I'll be able to start implementing the second phase within
the next few days.

Cheers
Sayamindu



[1] http://timesofindia.indiatimes.com/India/Rain_cripples_normal_life_in_Kolkata_for_the_second_day/rssarticleshow/2173778.cms,
http://www.telegraphindia.com/1070704/asp/frontpage/story_8014137.asp


--
Sayamindu Dasgupta
[http://sayamindu.randomink.org/ramblings]