[Kde-kiosk] [Bug 113969] New: kolourpaint can change wallpaper with locked down desktop

[Thiago Macieira]

Clarence Dang wrote:
>I think this might be a kdesktop issue rather than KolourPaint.

The fact that restarting kdesktop resets to the original wallpaper proves 
that the config was not changed. However, there are bugs in both apps:

kdesktop should not change the wallpaper. I don't know how KolourPaint 
told kdesktop to do it (probably via DCOP), but kdesktop should verify 
whether the change was allowed.

KolourPaint should not offer to change it if it can find out that such a 
change is locked down.

>If the security policy was only enforced in KolourPaint, someone could
> easily recompile KolourPaint with the security policy taken out.

There's no Kiosk security if you can run arbitrary applications, including 
the compiler or modified versions of the allowed applications. Kiosk is 
founded on the cooperation of the locked-down applications. Hence why use 
of non-KDE applications in a Kiosk environment is discouraged.

(How do you tell Firefox not to go to certain sites, or OpenOffice.org to 
respect certain restrictions?)

-- 
  Thiago Macieira  -  thiago (AT) macieira.info - thiago (AT) kde.org
    PGP/GPG: 0x6EF45358; fingerprint:
    E067 918B B660 DBD1 105C  966C 33F5 F005 6EF4 5358

1. On frumscafte, hwonne time_t wæs náht, se scieppend þone circolwyrde 
wundorcræftlíge cennede and seo eorðe wæs idel and hit wæs gód.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
Url : http://mail.kde.org/pipermail/kde-kiosk/attachments/20051006/e2161bab/attachment.pgp