Ubuntu and CentOS Are Undoing a GNOME Security Feature
Ubuntu is a complete Linux operating system, freely available with both community and professional support. The Ubuntu community is built on the ideas enshrined in the Ubuntu Manifesto: that software should be available free of charge, that software tools should be usable by people in their local language and despite any disabilities, and that people should have the freedom to customize and alter their software in whatever way they see fit.
Current versions of Ubuntu and CentOS are disabling a security feature that was added to the GNOME desktop environment last year.
The feature’s name is Bubblewrap, which is a sandbox environment that the GNOME Project added to secure GNOME’s thumbnail parsers in July 2017, with the release of GNOME.
Protect GNOME’s thumbnailing system
Thumbnail parsers are scripts that read files inside a directory and create thumbnail images to be used with GNOME, KDE, or other Linux desktop environments.
This operation takes place every time a user navigates to folders, and the OS needs to display thumbnails for the files contained within.
In recent years, security researchers have proven that thumbnail parses can be an attack vector when hackers trick a user into downloading a boobytrapped file on their desktop, which is then executed by the thumbnail parser.
Ubuntu, CentOS disable Bubblewrap feature
But according to German security researcher and journalist Hanno Boeck, the Ubuntu operating system is disabling Bubblewrap support inside GNOME for all recent OS versions.
Furthermore, Google security researcher Tavis Ormandy also discovered that GNOME Bubblewrap sandboxes were also missing in the default version of CentOS 7.x.
But there’s a valid explanation for what Ubuntu is doing, according to Alex Murray, Ubuntu Security Tech Lead at Canonical.
Murray says the Ubuntu team opted to disable GNOME’s Bubblewrap because they did not have the time and resources to audit the feature.
“Bubblewrap is relatively new software doing some complicated things to set up sandboxes,” Murray said. “If we just blindly promote it to [Ubuntu main] and then find out it has a vulnerability itself which we could have caught through code review beforehand that is not a good outcome for our users.”
Highest Selling Technical Courses of Indian Cyber Security Solutions:
Cybersecurity services that can protect your company:
Other Location for Online Courses: