3 ms·
Bear in mind that no it cannot write arbitrary files. It's a unix system, it has unix permissions, and required privilege escalation to write to locations the u
by 1_2__3 10y ago
Bear in mind that no it cannot write arbitrary files. It's a unix system, it has unix permissions, and required privilege escalation to write to locations the user is not allowed to.
- danieldk 10y agoIt's a unix system, it has unix permissions, and required privilege escalation to write to locations the user is not allowed to. Although strictly true, Unix DAC is a security model that stems from the 60/70ies. When a malicious actor gets read (or write) access to your home directory, it is pretty much game over (think cryptolocker, identity theft, loss of sensitive files, etc.). With vulnerabilities in internet-facing software being a fact of life, you want compromises to be restricted to their own little sandbox, not all the files in your home directory.
- oneeyedpigeon 10y agoWouldn't an application-specific user account (mostly) solve that problem without having to resort to a more complicated access control model?
- danieldk 10y agoThen you have to fiddle when you want the application to read/write a file in your home directory. So, then either the application has blanket access again or the user has to manager per-file groups or ACLs.
- oneeyedpigeon 10y agoSo a text editor gets the user's permissions, a game that writes a local save file has its own permissions ... what's an example app that wouldn't be able to work this way?