177
edits
Changes
m
→FLASK and SELinux for enforcing permissions
** an app, which for best results would run either its javascript engine or better its own entire gecko engine as a separate executable, would be granted a security context which allowed it only the rights to execute or access other programs (such as a dialer).
** in the case of JSONRPC service(s), the app would be granted SE/Linux permissions to access the URL which activated the dialer (this is one possible implementation)
* use of WebAPIs in the current implementation is ''impossible to properly protect against compromise''. '''once a process or thread is compromised, all other threads and processes must also be considered to be compromised'''.
Full Discussion on NSA's SE-Linux Mailing List:
