Hi Vincas,
Vincas Dargis:
> + # Allow opening attachments
> + /{usr/,}bin/* Cx -> sanitized_helper,
> + /{usr/,}sbin/* Cx -> sanitized_helper,
> + /usr/local/{bin,sbin}/* Cx -> sanitized_helper,
> + /usr/bin/evince Pix,
> + /usr/bin/totem Pix,
[...]
> Do we really need sbin? I kind doubt there will be "document viewers", and it
> has
> setuid applications like pppd and exim4, which is not comforting.
Good catch! Makes sense to me, feel free to drop the sbin bits as long
as it does not obviously break stuff in your tests :)
> Also, if sanitized_helper contains:
> `/{usr/,}bin/* Pixr,`
> Doesn't this automatically mean that this line in usr.bin.thunderbird profile
> `/{usr/,}bin/* Cx -> sanitized_helper,`
> will in result launch /usr/bin/totem with it's *P*rofile?
> I wonder, because `abstractions/ubuntu-media-players has `/usr/bin/totem Cxr
> -> sanitized_helper,`, maybe that would work?
> I'll do some testing tomorrow.
Indeed, it might be that the specific rules about evince & totem
you're quoting from my patch above are not needed. It would be nice if
we could drop them (and the maintenance cost of hard-coding a list of
exceptions) so I'm hoping your testing confirms your hypothesis :)
> If there's extra rules for XFCE, maybe I should try Thunderbird on several DE.
This would be sweet but right now the thing is totally broken, so
fixing them on the default DE (GNOME) only would be a huge improvement
already. I suggest you focus on getting this done first, and later we
can test (or call for testing!) on other DEs. There's no way we can
test all relevant configurations, so we'll need to rely on user
testing to some degree anyway.
Cheers,
--
intrigeri
