Re: gnome-panel menu lockdown proposal

[guenther <guenther rudersport de>]

On Mon, 2007-01-08 at 19:18 +0100, Vincent Untz wrote:
> Le lundi 08 janvier 2007, �6:07, guenther a �it :
> > > > * deskbar-applet
> > > 
> > > Just disallow use of the deskbar-applet completely, via disabled_applets.
> > 
> > So there is a third part involved the admin needs to take care of in
> > order to lock down anything...
> 
> We can make things easier with pessulus: if this lockdown setting is
> enabled, then we can also automatically add deskbar-applet to
> disabled_applets.

Yup...

However, my main goal remains: I want to raise hacker's and admin's
awareness of this issue. There are lots of ways to escape this
limitation, which should be addressed to seriously lock down as
advertised. Admins need to understand this might not be as complete as
expected and the name promises.

  guenther


-- 
char *t="\10pse\0r\0dtu\0  ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}