= phenomenon =

Recent changes to the packaging guidelines are unclear as to intent about whether services that listen on local/unix-domain network sockets only are now welcome to be default-on vs. previously default-off.

Note that this issue is separate from the default-off policy for traditional network servers, which are left to the spin/edition working groups' discretion to permit.

= background analysis =

https://fedoraproject.org/w/index.php?title=Packaging%3ADefaultServices&diff=413672&oldid=413670

https://lists.fedoraproject.org/pipermail/devel/2015-May/210768.html

= implementation recommendation =

Decision sought about whether previous security concerns (such as prevention of local privilege escalation) are now acceptable, traded against the extra out-of-the-box functionality possible with more services. Some possible outcomes:

1) Roll back the policy wording to "does not listen on a network socket" (as being a condition for default-on). Note that this older wording is also unclear, as e.g. unix-domain sockets may or may not be deemed "network sockets".

2) Adopt the more expansive/welcoming definition, designating the external network as the main source of threat and the localhost as only an acceptable lesser one.