Six questions

6 questions on what you just read. Nothing is saved or issued. Use the result to see which of the 4 lessons to revisit while they are still open in the rail. One question uses the playground on this page.

1. 1. You install a program the ordinary way, and it turns out to be malicious. What can it read?

   Nothing, until you grant it something Every file your own account can read Only the directories it declared it needed
2. 2. A cpak manifest does not mention the network at all. What can the application reach?

   Nothing off the machine Whatever the person installing it allows at the prompt The network, since nothing forbade it
3. 3. A manifest asks for displayX11. What does cpak keep isolated?

   Nothing: displayX11 is an alias for socketWayland The host X11 display, including other clients' clipboard, input and pixels Only the network route used by remote displays
4. 4. Keep only "socketWayland": true in the permissions playground. How many host paths does that one permission bind?

   One, the socket the window is drawn through No host path, because every display permission is brokered Two: the compositor socket and the lock beside it

   Playground for this question

   Package workspace

   Edit the manifest, then read the validation result.

   cpak.json

   cpak manifest { "$schema": "https://raw.githubusercontent.com/Containerpak/cpak/v2/schema/manifest-v3.json", "manifest_version": "3.0", "name": "notes", "description": "An example package for permission inspection.", "version": "3.0", "image": "ghcr.io/example/notes@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", "binaries": [ "/usr/bin/notes" ], "idle_time": 5, "override": { "socketWayland": true, "socketPulseAudio": true, "notification": true, "openURI": true, "network": true } }

   $ cpak validate

   Loading cpak...

   $ Run a command Enter to run

   Permission names available in this build

   Add a key under override and the result above changes immediately.

5. 5. What does adding "deviceDri": true to an administrator's ceiling change?

   It grants the graphics device to every package on that host It grants the graphics device only to packages that ask for it Nothing. A true ceiling entry is the same as leaving the key out
6. 6. You install a package and the prompt lists a permission you would rather it did not have. What can you do?

   Take it away, and put it back later if the application turns out to need it Edit the manifest before installing Nothing. It is the publisher's decision