5 ms·

Why do userland installers need root again?

londons_explore 7y ago
In the case of Chrome it's because some of the sandboxing can't be done by a regular user. Same with both Linux and windows. Bit of a design flaw with the OS - in all cases a process should be allowed to restrict itself to have fewer permissions and access to fewer API's without being root, but sadly that isn't universally the case.
- saagarjha 7y ago
  You can't apply a sandbox profile against yourself if you're not root?
- the8472 7y ago
  On windows and linux most installers are intended for system-wide instead of per-user installation. You can get most of the sandboxing functionality without admin/root.
- mehrdadn 7y ago
  > Same with both Linux and windows. Could you clarify how this is the case on Windows? I thought Google Chrome installs and runs just fine without admin privileges. I'm not aware of any security downsides for doing so.
  - judge2020 7y ago
    Maybe it's possible but the current installer has windows pop up a UAC prompt before it continues.
    - mehrdadn 7y ago
      That's just because it wants to install machine-wide if possible. You can just tell it to continue without admin permissions and it tells you explicitly that it can be installed without that. Note that Windows doesn't work like Linux with setuid bits and whatnot. The permissions a file is installed with don't dictate what permissions the program that executes it has. That's entirely a function of the program's security context. Hence, for a machine-wide installation to actually make a difference security-wise, Google would actually have to install e.g. a high-privilege service that would run when you try to start Chrome. I don't think it does such a thing. So I think Windows is already designed correctly in this regard and hence I don't think this is an issue on Windows as claimed.
- colejohnson66 7y ago
  Didn’t BSD implement something like that? The program says: these are the features I need, disable all the others?
  - protomyth 7y ago
    OpenBSD and the Chrome port has both unveil and pledge enabled.
- viraptor 7y ago
  > Same with both Linux and windows. That doesn't seem right, unless you mean some specific version of sandboxing? Changing selinux/apparmor hats, setting up seccomp, creating namespaces, and others can be done just fine by regular users. They're all sandboxes.
- cjbprime 7y ago
  > In the case of Chrome it's because some of the sandboxing can't be done by a regular user. > Same with both Linux and windows. This isn't true anymore on Linux. Chrome switched to using an unprivileged user namespace sandbox instead of the old SUID sandbox is Chrome 43 in 2015. It depends on a Linux 3.8+ kernel for the user namespaces support.

In the case of Chrome it's because some of the sandboxing can't be done by a regular user. Same with both Linux and windows. Bit of a design flaw with the OS - in all cases a process should be allowed to restrict itself to have fewer permissions and access to fewer API's without being root, but sadly that isn't universally the case.

saagarjha 7y ago
You can't apply a sandbox profile against yourself if you're not root?
the8472 7y ago
On windows and linux most installers are intended for system-wide instead of per-user installation. You can get most of the sandboxing functionality without admin/root.
mehrdadn 7y ago
> Same with both Linux and windows. Could you clarify how this is the case on Windows? I thought Google Chrome installs and runs just fine without admin privileges. I'm not aware of any security downsides for doing so.
- judge2020 7y ago
  Maybe it's possible but the current installer has windows pop up a UAC prompt before it continues.
  - mehrdadn 7y ago
    That's just because it wants to install machine-wide if possible. You can just tell it to continue without admin permissions and it tells you explicitly that it can be installed without that. Note that Windows doesn't work like Linux with setuid bits and whatnot. The permissions a file is installed with don't dictate what permissions the program that executes it has. That's entirely a function of the program's security context. Hence, for a machine-wide installation to actually make a difference security-wise, Google would actually have to install e.g. a high-privilege service that would run when you try to start Chrome. I don't think it does such a thing. So I think Windows is already designed correctly in this regard and hence I don't think this is an issue on Windows as claimed.
colejohnson66 7y ago
Didn’t BSD implement something like that? The program says: these are the features I need, disable all the others?
- protomyth 7y ago
  OpenBSD and the Chrome port has both unveil and pledge enabled.
viraptor 7y ago
> Same with both Linux and windows. That doesn't seem right, unless you mean some specific version of sandboxing? Changing selinux/apparmor hats, setting up seccomp, creating namespaces, and others can be done just fine by regular users. They're all sandboxes.
cjbprime 7y ago
> In the case of Chrome it's because some of the sandboxing can't be done by a regular user. > Same with both Linux and windows. This isn't true anymore on Linux. Chrome switched to using an unprivileged user namespace sandbox instead of the old SUID sandbox is Chrome 43 in 2015. It depends on a Linux 3.8+ kernel for the user namespaces support.