ScopesConfinement

Differences between revisions 1 and 2
Revision 1 as of 2013-08-30 12:38:20
Size: 46
Editor: strehl-t
Comment:
Revision 2 as of 2013-08-30 12:40:41
Size: 759
Editor: strehl-t
Comment:
Deletions are marked like this. Additions are marked like this.
Line 1: Line 1:
= Scopes Confinement = = Introduction =
Line 3: Line 3:
== Introduction == For 13.10, scopes will not be available in the app store and application
confinement[1] will prevent apps from abusing scopes and the scopes
architecture. For 14.04 we'd like to have app developers able to deliver scopes
via the app store. For us to be able to have scopes deliverable via click
packages, we'll need to carefully design the system to support confining scopes.

Scopes create a number of interesting challenges when considering application
confinement. There are two overarching issues wrt to scopes.

 * apps - ie, apps can't attack the system (ie, scopes, the dash, etc to
   ship off data, enumerate things, etc)
 * scopes - ie, scopes can't attack the system (ie, the dash, other
   scopes, user data, etc)

Introduction

For 13.10, scopes will not be available in the app store and application confinement[1] will prevent apps from abusing scopes and the scopes architecture. For 14.04 we'd like to have app developers able to deliver scopes via the app store. For us to be able to have scopes deliverable via click packages, we'll need to carefully design the system to support confining scopes.

Scopes create a number of interesting challenges when considering application confinement. There are two overarching issues wrt to scopes.

  • apps - ie, apps can't attack the system (ie, scopes, the dash, etc to
    • ship off data, enumerate things, etc)
  • scopes - ie, scopes can't attack the system (ie, the dash, other
    • scopes, user data, etc)

SecurityTeam/Specifications/ScopesConfinement (last edited 2014-11-03 15:04:53 by jdstrand)