[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20190711114710.09ab5ad9@jabberwock.cb.piermont.com>
Date: Thu, 11 Jul 2019 11:47:10 -0400
From: "Perry E. Metzger" <perry@...rmont.com>
To: oss-security@...ts.openwall.com
Cc: Malte Kraus <malte.kraus@...e.com>
Subject: Re: Privileged File Access from Desktop Applications
On Thu, 11 Jul 2019 13:57:19 +0000 Malte Kraus <malte.kraus@...e.com>
wrote:
> On Thu, 2019-07-11 at 09:33 -0400, Perry E. Metzger wrote:
> > So these links seem to say that things have been structured so you
> > *can't* run GUI apps as root, not that there is a special or
> > unusual security problem in Wayland if you run an application as
> > root
> I didn't (intend to) say there is an (additional) security problem.
> I just tried to succinctly explain why the desktop environments are
> coming up with these D-Bus interfaces now.
It seems like a bad idea.
If one wants to have mechanisms by which the operating system can
allow unprivileged programs to temporarily assume privileges (which
is a frequent idea in security), then they should be carefully
designed and part of the OS, rather than creating an ad hoc facility
via a subsystem that isn't intended for it. There are good ways to do
that, like capabilities.
The ad hoc solution creates a situation where quite ordinary programs
like editors suddenly need two distinct sets of file i/o primitives
with very distinct security properties to do ordinary things like
editing files, and where (as I said) subsystems not intended to
handle file security suddenly are in charge of it.
Honestly, for day to day editing of administration files, I'd
far rather be able to pop open an editor on my machine as root for a
moment than have a complicated facility. "Protecting" me from this
probably has no significant benefit in terms of real-world threats,
but having to add file i/o subsystems inside of dbus(!) probably does
add lots of threats. Failing that, though, I'd rather people finally
add a real solution (like a capability subsystem, see Capsicum for
example) instead of fooling around with fragile, ad hoc designs.
Perry
--
Perry E. Metzger perry@...rmont.com
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
