Tails

As we found out in Bug #10836#note-9, unfiltered access to the session D-Bus bus allows a confined application to have the session’s dbus-daemon execute any D-Bus activatable app. The executed application will run under its own AppArmor profile, if it has one, and unconfined otherwise. In Tails 2.4, the D-Bus activatable applications we ship are: Totem, Nautilus, Screenshot, PortalHelper and gedit.

So the next question is: is it acceptable? How can an attacker, who controls Tor Browser, leverage this to do stuff they should be forbidden to? Shall we make all apps non-D-Bus-activatable?

While researching all these questions, let’s keep in mind that to get working input systems and accessibility support, we need to give Tor Browser access to the session bus anyway (and unfiltered access until the kernel patches needed to filter D-Bus calls make it into mainline Linux).