Six questions

Six questions on what you have just read. Nothing is recorded and nothing is issued for it: it is here so you find out which of the four lessons to read again, while you still have them open in the rail. One of them needs the playground on this page.

1. 1. You install a program the ordinary way, and it turns out to be malicious. What can it read?

   Nothing, until you grant it something Every file your own account can read Only the directories it declared it needed
2. 2. A cpak manifest does not mention the network at all. What can the application reach?

   Whatever the person installing it allows at the prompt The network, since nothing forbade it Nothing off the machine
3. 3. A manifest asks for socketX11. What does that one line open?

   The display, and with it the clipboard, the keystrokes and the pixels of every other window on it One socket, for drawing a window Nothing on its own: it needs socketWayland too
4. 4. Keep only "socketWayland": true in the permissions playground. How many host paths does that one permission bind?

   Two: the compositor socket and the lock beside it One, the socket the window is drawn through Six, once the display is counted

   The playground for this question

   Package workspace

   Edit the manifest, then validate it without leaving the browser.

   cpak.json

   cpak manifest { "manifest_version": "2.0", "name": "notes", "description": "An example package for permission inspection.", "image": "ghcr.io/example/notes:2", "binaries": [ "/usr/bin/notes" ], "override": { "socketWayland": true, "socketPulseAudio": true, "notification": true, "openURI": true, "network": true } }

   $ cpak validate

   Loading cpak's decision module...

   $ Run a command Enter to run

   Permission names available in this build

   Add a key under override, save nothing, and watch the result above change immediately.

5. 5. An administrator's ceiling contains "deviceDri": true. What does that give a package?

   The graphics device for packages that also ask for it, and for nothing else Nothing. It says the host will not stand in the way of a package that asks for it The graphics device, on every installation on that host
6. 6. You install a package and the prompt lists a permission you would rather it did not have. What can you do?

   Edit the manifest before installing Nothing. It is the publisher's decision Take it away, and put it back later if the application turns out to need it