Skip to content

Research what to do wrt. D-Bus activatable apps and AppArmor

As we found out in #10836-note_9, unfiltered access to the session D-Bus bus allows a confined application to have the session’s dbus-daemon execute any D-Bus activatable app. The executed application will run under its own AppArmor profile, if it has one, and unconfined otherwise. In Tails 2.4, the D-Bus activatable applications we ship are: Totem, Nautilus, Screenshot, PortalHelper and gedit.

So the next question is: is it acceptable? How can an attacker, who controls Tor Browser, leverage this to do stuff they should be forbidden to? Shall we make all apps non-D-Bus-activatable?

While researching all these questions, let’s keep in mind that to get working input systems and accessibility support, we need to give Tor Browser access to the session bus anyway (and unfiltered access until the kernel patches needed to filter D-Bus calls make it into mainline Linux).

Related issues

Original created by @intrigeri on 11579 (Redmine)

Edited by intrigeri
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information