Announce: Powerbox for Gtk, part of Plash 1.15

[Mark Seaborn <mseaborn onetel com>]

I talked about this on this mailing list before.  An implementation is
now available:

http://plash.beasts.org/powerbox/
http://plash.beasts.org/releases/plash-1.15.tar.gz

Powerbox for Gtk is a patch to Gtk which replaces its
GtkFileChooserDialog with a powerbox, a kind of file chooser that is
implemented by a separate process.

A file powerbox works the same as a normal file chooser from the
user's perspective.  The difference is that as well as telling the
application which file to access, it dynamically grants the
application the right to access the file.

This helps provide security because it means that the application does
not have to be given access to all of the user's files by
default.  This is an example of applying the principle of least
privilege/authority: the aim is to give the program the authority it
needs to do its job, but no more.


The patch works as an LD_PRELOADed library.  See src/gtk-powerbox.c
in the source.

The change to Gtk is not straightforward, because unfortunately the
GtkFileChooserDialog interface was not intended to be used this way.
It is not a call-return style interface.  The GtkFileChooserDialog
class inherits from the classes GtkWidget, GtkWindow, etc., so
applications can expect it to provide these interfaces.  With the
powerbox patch, GtkFileChooserDialog no longer inherits from these
classes, so most methods become no-ops.  One exception is
gtk_widget_show(), which is intercepted so that it sends the message
to the powerbox manager to open the file chooser dialog box.

I've only given this limited testing.  It works with Leafpad (a simple
text editor).  It has some problems with Gnumeric -- some more signals
need to be implemented for GtkFileChooserDialog for this to work.

The powerbox system uses Plash to control a process's ability to open
files.  Plash is a restricted execution environment for Linux.  You
can run a program under Plash to use the powerbox with a command such
as this:

  pola-run --prog /usr/bin/leafpad \
    --env LD_PRELOAD=powerbox-for-gtk.so \
    -B -fl /etc \
    --x11 --powerbox --pet-name "Leafpad"

Mark