ubuntu-touch-coreapps-reviewers team mailing list archive

[Alan Pope  <alan@xxxxxxxxxx>]

Review: Needs Fixing

I'm concerned about the unconfined nature of this. Normally for some core apps where there's no other way, I'd probably be okay with this. However, as we're now carrying all of LibreOffice, I'm concerned that we're opening ourselves up by having an unconfined copy of LibreOffice potentially able to be exploited by a dodgy document. That's quite a significantly sized attack surface. Especially when we don't generally roll out new builds of the docviewer with security updated LibreOffice builds very regularly.

What do you think? Should we push this feature back until we have a non-unconfined solution?

Should we bring this up with platform team to find some other way to do this?
-- 
https://code.launchpad.net/~verzegnassi-stefano/ubuntu-docviewer-app/desktop-support2/+merge/284901
Your team Ubuntu Document Viewer Developers is subscribed to branch lp:ubuntu-docviewer-app.