D29407: ScreenshotEffect: Use Service Property to authorize screenshot without confirmation
Méven Car <[email protected]>
| Newsgroups | gmane.comp.kde.devel.kwin |
|---|---|
| Message-ID | <[email protected]> |
meven added a comment. It has been reminded me that this solution to have some security rest entirely on the guarantees offered by $XDG_DATA_DIRS. Same can be said about X-KDE-Wayland-Interfaces. But currently I believe this does not constitutes a strong security model. A malicious executable could manufacture a fake $XDG_DATA_DIRS, add an application folder in it and a desktop file for its executable, trigger kbuildsyscoca5 and then use any of the restricted interfaces. We would need further to restrict path for which we would consider the desktop file, for instance, like only root owned path. REPOSITORY R108 KWin REVISION DETAIL https://phabricator.kde.org/D29407 To: meven, #kwin, apol, davidedmundson, bport Cc: ngraham, kwin, Orage, cacarry, LeGast00n, The-Feren-OS-Dev, cblack, jraleigh, zachus, fbampaloukas, mkulinski, ragreen, jackyalcine, iodelay, crozbo, bwowk, ZrenBot, alexeymin, himcesjf, lesliezhai, ali-mohamed, hardening, romangg, jensreuterberg, abetts, sebas, apol, ahiemstra, mart