Description of problem: On default gnome Fedora 20 installation it is configured to run software on new inserted media by default. This is a high risk security broken configuration IMO. This has been fixed in windows long ago. Attaching screenshot.
Created attachment 866917 [details] screenshot from default config
Hi Aleksandar, Thanks for reporting this. When you insert media does it not ask "...contains software intented to be automcatically started. Would you like to run it?"? It just ran automatically for you? Testing here it asked, which is in line with the " You will always be prompted for a confirmation before software is run." documentation on: https://help.gnome.org/users/gnome-help/3.5/files-autorun.html.en Thanks, -- Murray McAllister / Red Hat Security Response Team
Good question. How do I prepare a media that will be recognized as software?
Someone else actually tested this for me ;) Today on RHEL 6 I just added a ".autorun" file to a normal USB drive, which contained the following #!/bin/bash gedit When I inserted the drive it said it had software that wanted to run automatically. When I clicked "yes" through the prompts gedit appeared.
That's partially good IMO. But I'm wondering if suggesting to user to run software is a good idea actually. If one looks at windows, they try to avoid running unsigned or software with unknown signature. In the same way, IMO it's better to not make it too easy for user to run some random software on removable media.
Right, the message/what is going to happen may not be clear to users and they may unintentionally run something they were not expecting. As the documentation states you will be asked before auto running (and this appears to work as documented), we would not treat the current situation as a security flaw (unless you disagree, I am not familiar with the auto run situation on Windows platforms). I will remove the Security group and you can open the bug up when you are ready. Let me know if I have missed something.
Thank you Murray, I agree with your analysis. I would suggest that we do not enable auto-running software by default (even with the simple confirmation dialog that we have now) from removable media until we have some mechanism to identify trusted vs untrusted sources. Regards
Created attachment 883758 [details] A gsettings-desktop-schemas patch to change the default autorun behavior for software The GNOME docs to claim that it will always ask, but the default configuration of "Run Software" does not convey that and is inconsistent with all of the others which 'Ask what to do'. Attached is a patch that changes the default in the schema back to 'Ask what to do'. After applying this patch I then had to run this command to reset the value to the new default: `gsettings reset org.gnome.desktop.media-handling autorun-x-content-start-app`.
This message is a reminder that Fedora 20 is nearing its end of life. Approximately 4 (four) weeks from now Fedora will stop maintaining and issuing updates for Fedora 20. It is Fedora's policy to close all bug reports from releases that are no longer maintained. At that time this bug will be closed as EOL if it remains open with a Fedora 'version' of '20'. Package Maintainer: If you wish for this bug to remain open because you plan to fix it in a currently maintained version, simply change the 'version' to a later Fedora version. Thank you for reporting this issue and we are sorry that we were not able to fix it before Fedora 20 is end of life. If you would still like to see this bug fixed and are able to reproduce it against a later version of Fedora, you are encouraged change the 'version' to a later Fedora version prior this bug is closed as described in the policy above. Although we aim to fix as many bugs as possible during every release's lifetime, sometimes those efforts are overtaken by events. Often a more recent Fedora release includes newer upstream software that fixes bugs or makes them obsolete.
Fedora 20 changed to end-of-life (EOL) status on 2015-06-23. Fedora 20 is no longer maintained, which means that it will not receive any further security or bug fix updates. As a result we are closing this bug. If you can reproduce this bug against a currently maintained version of Fedora please feel free to reopen this bug against that version. If you are unable to reopen this bug, please file a new report against the current release. If you experience problems, please add a comment to this bug. Thank you for reporting this bug and we are sorry it could not be fixed.