Sharing Network Awareness

Status: Planning

Description

The goal of this feature is avoid unintentional oversharing of private information (“Pants down”), as well as to protect the integrity of the system, when connecting the system to public or untrusted networks.

Oversharing

Information that could be shared, or services advertised on a typical workstation environment:

• Person’s name, or device name (Avahi, Bluetooth)
• Files through Personal File Sharing (WebDAV)
• Screen/Login (through vino, ssh)
• Media (Photos, Music) through Rhythmbox, or DLNA (Rygel)
• Eventually, hardware such as Printers or Optical Disc drives

Most of those are controlled through the Sharing panel in System Settings, except in-app sharing such as Rhythmbox’ DMAP sharing.

Integrity of the system

Apart from sshd which runs as a system service, all the other applications run as the unprivileged logged-in user in the session context, with no containerisation. Exposing these applications to attacks from the network risks the integrity of the system.

Solutions

Traditionally, a firewall is the solution to the integrity aspect of this, in particular in connection with uncooperative and 3rd party applications. But that solution usually falls short in terms of informing the user and putting him in control. Better solutions...are still being discussed.

Owner

Matthias Clasen, Bastien Nocera

Involved Parties

Affected modules: gnome-control-center, gnome-settings-daemon, NetworkManager, firewalld

Current Status

NetworkManager has support for firewall 'zone' information that is associated with connections. On Fedora, firewalld uses that information to dynamically set up iptables, etc. The control-center network panel has minimal UI for setting the zone of a connection. The sharing panel does not yet tie the status of various sharing settings to the current network - it is either on or off.

Better solutions are being discussed in 727580.

How to Help

Chime in on 727580. If you are an application developer with network-facing functionality, it would be great to hear your thoughts on suitable API for applications to learn that they are blocked by a firewall.