Is this actually an issue for confined apps? Mirco and I looked at this
before and I thought there was a separate DBus API for snap decisions.
Apps aren't allowed to use snap decisions IIRC, but may use the push-
notification-client policy group:
# Description: Can use push notifications as a client
# Usage: common
dbus (receive, send)
bus=session
interface=com.ubuntu.PushNotifications
path=/com/ubuntu/PushNotifications/@{APP_PKGNAME_DBUS}{,/**},
dbus (receive, send)
bus=session
interface=com.ubuntu.Postal
path=/com/ubuntu/Postal/@{APP_PKGNAME_DBUS}{,/**},
Are snap decisions somehow following under the above paths/interfaces?
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to unity8 in Ubuntu.
https://bugs.launchpad.net/bugs/1306769
Title:
pinlock snap decision potentially allows malicious app to gain access
to user PIN and Passcode
Status in Server and client library for desktop notifications in Unity:
Triaged
Status in The Unity 8 shell:
Triaged
Status in “unity8” package in Ubuntu:
Triaged
Bug description:
Currently the pinlock dialog is implemented as snapdecision and thus
any application that is allowed to use the notifications can
potentially trick the user to provide his PIN code or Passcode to the
application by invoking the pinlock dialog.
As we want to allow applications to send normal notifications and
snapdecisions we can't just block the whole notify service from them,
but also we don't have any means to block just one of them.
Thus the only solution is to remove the pinlock from snap decisions
completely and implement a standalone dbus service for pinlock dialog
which can be properly confined.
To manage notifications about this bug go to:
https://bugs.launchpad.net/unity-notifications/+bug/1306769/+subscriptions
--
Mailing list: https://launchpad.net/~touch-packages
Post to : touch-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~touch-packages
More help : https://help.launchpad.net/ListHelp
