Warning, /plasma/plasma-desktop/design/security is written in an unsupported language. File is not indexed.
0001 Security 0002 ======== 0003 0004 overview 0005 -------- 0006 0007 plasma will have three types of security: 0008 -co-operative 0009 -trust-based 0010 -enforced 0011 0012 co-operative security 0013 --------------------- 0014 0015 this is fairly basic security for plasmoids. 0016 the idea is, shells (like plasma-overlay) can specify a list of constraints in their desktop file, and then all plasmoids that require the disabled feature don't show up in the appletbrowser. also, plasmoids that would like a certain feature but don't *need* it can check hasAuthorization() and turn it off when it's not allowed. 0017 This type of security relies heavily on plasmoid developers. Each plasmoid's .desktop file must list what features the plasmoid requires, and be kept up to date with the code. X-Plasma-Requires-<feature> can be set to Required, Unused, or Optional. Example: X-Plasma-Requires-FileDialog=Required 0018 Features the plasmoid would like but does not require should be guarded by hasAuthorization, and set to Optional in the .desktop. [example](http://websvn.kde.org/?view=rev&revision=967792). 0019 All the plasmoids in workspace and kdeplasma-addons should probably be reviewed before release. some of them don't have an active maintainer to take responsibility. 0020 0021 Currently, plasmoids that don't mention a constraint are assumed to not use it. however, by release time the opposite should be true. this is just so that they don't *all* disappear from the screensaver before anyone has a chance to review their plasmoids. 0022 Note that this will not remove existing instances of plasmoids. It only hides them from the appletbrowser. Users who really really want to can edit the config file to add unsafe applets. 0023 0024 Existing constraints/features: 0025 -FileDialog. When this is restricted, use of open or save dialogs is forbidden. Reason: users can delete files from there and cause all kinds of havoc. 0026 -LaunchApp. When this is restricted, running other applications or opening urls (generally done through KRun) is forbidden. Reason: although they're not accessible from the screensaver, they can still pile up and need to be closed after the screen's unlocked. 0027 0028 ^^ this is obviously not a final list. more will be added soon. 0029 0030 possible problems: 0031 -the API isn't designed for constraints changing at runtime. does anyone think that's likely to matter someday? 0032 -I have no idea how this will affect alien widgets. personally I'd be fine with banning those from the screensaver until proper, full security can be implemented. 0033 0034 0035 trust-based security 0036 -------------------- 0037 0038 gpg signing of plasmoids 0039 0040 0041 enforced security 0042 ---------------- 0043 0044 This is security that doesn't rely on plasmoid developers. Mostly it's about disabling access to features via the scripting API, so that plasmoids using that API absolutely cannot use the disabled features. 0045 0046 it'd be nice if we could use KAuthorized to enforce some stuff on the c++ applets... I tried, but didn't get anywhere. 0047 0048 0049 misc 0050 ---- 0051 0052 I'm not sure what categories these fall under. 0053 0054 category exclusion: entire categories of plasmoids can be excluded from the appletbrowser. for example, application launchers are excluded from the screensaver because they'd never ever be wanted there. 0055 0056 configuration locking: on the screensaver, config dialogs can't be accessed while the screen is locked. however, it's possible for a c++ plasmoid to override showConfigurationInterface and circumvent this. 0057