[OLPC Security] launching an activity from an activity

[Mikus Grinbergs]

One of the principles of Sugar is "Activities are isolated from each
other". Based on that, the launching of an Activity by another
Activity is prohibited. From the viewpoint of an user, I would like
to explore this prohibition.

--------

When an Activity is launched, Rainbow first creates an execution
environment by performing certain actions and passing certain
parameters, then lets the Activity run. As far as the Activity is
concerned, it has received all of its "dynamic input" thru Rainbow.

The launching process is typically triggered by the user clicking on
an icon - one place where this is allowed is in Journal. Even
though Journal itself is sometimes handled by Sugar the same way as
an Activity would be (e.g., where Journal currently gets shown is in
Activity View), Rainbow isolates the Activity (which runs after the
'launch') from Journal (which ran before the 'launch').

It seems to me that this same "separation" (between the before and
the after) ought to be possible if the trigger for the launch came
from an Activity. Activity-1 would cause Rainbow to run, and
Rainbow would set up Activity-2 the same way as it would for a
launch from click-on-icon.


The only difficulty I see with this is if Activity-1 is accessing a
resource that is needed by Activity-2 (Activity-1 may have to "give
up" that resource). If the resource was "dynamic output" from
Activity-1, it would have to be placed where both Activities have
permission to access (e.g., in /tmp), and its location would have to
be passed by Rainbow to Activity-2 (presumably by a mechanism
similar to the way information from a Journal entry is passed to an
Activity launched from that entry).


Please, do comment on how feasible this would be.


Thanks in advance, mikus

[Bert Freudenberg]

Post by Mikus Grinbergs
The only difficulty I see with this is if Activity-1 is accessing a
resource that is needed by Activity-2 (Activity-1 may have to "give
up" that resource). If the resource was "dynamic output" from
Activity-1, it would have to be placed where both Activities have
permission to access (e.g., in /tmp), and its location would have to
be passed by Rainbow to Activity-2 (presumably by a mechanism
similar to the way information from a Journal entry is passed to an
Activity launched from that entry).

Well, I don't think the launching of an activity from another is that
controversial (it might still be a DOS if an activity spawns others
continuously). The point is passing data from one to the next without
user interaction. The scenario is something like one activity reads
private data, encodes it in a URL and has Browse open it, which gets
sent to some malicious dude in Kansas. To prevent that we put the link
in the Journal and hope the user will figure out if it is safe to
click that entry or not. Which I do find silly, it's no better than a
"do you really want to ..." dialog.

From a user's POV I want to click on a URL sent by a buddy in Chat
and have the browser go there without further ado. Or, if a user
clicks a PDF link in Browse it should open in Read, no questions
asked. I fail to see why putting stuff in the Journal helps security.

- Bert -