Security manager bug (?)

[Bomyne]

Really hope this is a bug and not by design.

I just updated the WoWI modual and as far as I know, the security manager should have reappeared to let me know it had changed and to regrant permissions. It didn't.

[Tristanian]

I think it only fires when you install (not update) a module for the first time, but I could be wrong. Shirik can clarify once he is available

[Shirik]

This is by design.

For unsigned modules, the only real way to compare them is by name -- if it were replaced by something else, I wouldn't have a good way of knowing. Furthermore, I don't want to annoy the user every time the file has legitimately changed.

So, for unsigned modules, security permissions are granted to a bundle name. Signed modules (while as of yet unimplemented) will be granted to their name and it will be enforced that they are signed by the same certificate.

If anyone feels this isn't a valid approach, feel free to offer suggestions. Keep in mind usability is important.

[septor]

Is there anything in place to stop a module from playing nice at first to get permission and then change during an update to cause havoc?

[Shirik]

At any time, during an update or otherwise, if a module's permission requests change, the user will be notified and approval will be requested again.

I encourage anyone with sufficient experience to try to break through the security manager through whatever exploit vector you can find. If any issues are found, please report them so they can be sealed.

[Bomyne]

Personally, I believe that everytime a minion mod changes, it should revoke all security permissions and allow the user to regrant it.

Just an opinion through