Re: Privileged File Access from Desktop Applications

["Perry E. Metzger" <perry () piermont com>]

On Thu, 11 Jul 2019 13:57:19 +0000 Malte Kraus <malte.kraus () suse com>
wrote:
> On Thu, 2019-07-11 at 09:33 -0400,  Perry E. Metzger wrote:
> > So these links seem to say that things have been structured so you
> > *can't* run GUI apps as root, not that there is a special or
> > unusual security problem in Wayland if you run an application as
> > root  
> I didn't (intend to) say there is an (additional) security problem.
> I just tried to succinctly explain why the desktop environments are
> coming up with these D-Bus interfaces now.

It seems like a bad idea.

If one wants to have mechanisms by which the operating system can
allow unprivileged programs to temporarily assume privileges (which
is a frequent idea in security), then they should be carefully
designed and part of the OS, rather than creating an ad hoc facility
via a subsystem that isn't intended for it. There are good ways to do
that, like capabilities.

The ad hoc solution creates a situation where quite ordinary programs
like editors suddenly need two distinct sets of file i/o primitives
with very distinct security properties to do ordinary things like
editing files, and where (as I said) subsystems not intended to
handle file security suddenly are in charge of it.

Honestly, for day to day editing of administration files, I'd
far rather be able to pop open an editor on my machine as root for a
moment than have a complicated facility. "Protecting" me from this
probably has no significant benefit in terms of real-world threats,
but having to add file i/o subsystems inside of dbus(!) probably does
add lots of threats. Failing that, though, I'd rather people finally
add a real solution (like a capability subsystem, see Capsicum for
example) instead of fooling around with fragile, ad hoc designs.


Perry
-- 
Perry E. Metzger                perry () piermont com