oss-sec mailing list archives
Re: Privileged File Access from Desktop Applications
From: "Perry E. Metzger" <perry () piermont com>
Date: Thu, 11 Jul 2019 11:47:10 -0400
On Thu, 11 Jul 2019 13:57:19 +0000 Malte Kraus <malte.kraus () suse com> wrote:
On Thu, 2019-07-11 at 09:33 -0400, Perry E. Metzger wrote:So these links seem to say that things have been structured so you *can't* run GUI apps as root, not that there is a special or unusual security problem in Wayland if you run an application as rootI didn't (intend to) say there is an (additional) security problem. I just tried to succinctly explain why the desktop environments are coming up with these D-Bus interfaces now.
It seems like a bad idea. If one wants to have mechanisms by which the operating system can allow unprivileged programs to temporarily assume privileges (which is a frequent idea in security), then they should be carefully designed and part of the OS, rather than creating an ad hoc facility via a subsystem that isn't intended for it. There are good ways to do that, like capabilities. The ad hoc solution creates a situation where quite ordinary programs like editors suddenly need two distinct sets of file i/o primitives with very distinct security properties to do ordinary things like editing files, and where (as I said) subsystems not intended to handle file security suddenly are in charge of it. Honestly, for day to day editing of administration files, I'd far rather be able to pop open an editor on my machine as root for a moment than have a complicated facility. "Protecting" me from this probably has no significant benefit in terms of real-world threats, but having to add file i/o subsystems inside of dbus(!) probably does add lots of threats. Failing that, though, I'd rather people finally add a real solution (like a capability subsystem, see Capsicum for example) instead of fooling around with fragile, ad hoc designs. Perry -- Perry E. Metzger perry () piermont com
Current thread:
- Privileged File Access from Desktop Applications Malte Kraus (Jul 09)
- Re: Privileged File Access from Desktop Applications Perry E. Metzger (Jul 09)
- Re: Privileged File Access from Desktop Applications Perry E. Metzger (Jul 10)
- Re: Privileged File Access from Desktop Applications Malte Kraus (Jul 11)
- Re: Privileged File Access from Desktop Applications Perry E. Metzger (Jul 11)
- Re: Privileged File Access from Desktop Applications Matthias Gerstner (Jul 11)
- Re: Privileged File Access from Desktop Applications Malte Kraus (Jul 11)
- Re: Privileged File Access from Desktop Applications Perry E. Metzger (Jul 11)
- Re: Privileged File Access from Desktop Applications Bob Friesenhahn (Jul 11)
- Re: Privileged File Access from Desktop Applications John Haxby (Jul 11)
- Re: Privileged File Access from Desktop Applications Simon McVittie (Jul 11)
- Re: Privileged File Access from Desktop Applications Simon McVittie (Jul 11)
- Re: Privileged File Access from Desktop Applications Perry E. Metzger (Jul 11)
- Re: Privileged File Access from Desktop Applications Jordan Glover (Jul 12)
- Re: Privileged File Access from Desktop Applications Perry E. Metzger (Jul 12)
- Re: Privileged File Access from Desktop Applications Perry E. Metzger (Jul 12)
- Re: Privileged File Access from Desktop Applications Steffen Nurpmeso (Jul 12)
- Re: Privileged File Access from Desktop Applications Perry E. Metzger (Jul 09)
- Re: Privileged File Access from Desktop Applications Steffen Nurpmeso (Jul 11)