5 ms·

I think we are really conflating "app store distribution" and "the POSIX userland isn't workable in a modern security environment for end-users". POSIX apps run

I think we are really conflating "app store distribution" and "the POSIX userland isn't workable in a modern security environment for end-users". POSIX apps run as the user, when they really need to be run with their own identity. Most often we should use the identity of the "developer". Do I want Firefox to have access to my Contacts? My Photos? Do I want Facebook to have that access? To all of them, or just ones that I select? Should my disk utility have the ability to send data over the network? My IDE? My IDE plugins? This has nothing to do with "stores", and everything to do with the security model and the UI needed to make it work. e.g., when I run `grep -e "Something" -r ~/src`, I assume grep is going to read all of the files in ~/src. But in the basic POSIX environment it can access anything I can (including, say, ~/.ssh) and open up any old socket it wants and send data wherever it chooses. Have you read every line of code of every package you've installed? Rather than relying on 'trust', 2021 requires that we actually have some security model that doesn't rely on trust, but explicit permissions and grants, and workable UI for defining that. Wouldn't it be nice if bash arranged a read-only capability granted to the grep process for all files under ~/src based on the above command, and if the grep executable itself had no inherent permissions at all?

viraptor 5y ago
That's pretty much selinux. We don't have a nice ui for it, because what you described is actually pretty complicated to achieve. But it actually works. Today.
- mikepurvis 5y ago
  Socket/port activation in the init system tries to be a piece of this puzzle too, though obviously it's far from the whole story.
heavyset_go 5y ago
> Do I want Firefox to have access to my Contacts? My Photos? Do I want Facebook to have that access? To all of them, or just ones that I select? Should my disk utility have the ability to send data over the network? My IDE? My IDE plugins? Modern security on Linux is hardly dependent on the POSIX security model. Linux just got the Landlock feature[1] in the kernel[2] that does just this. Along with Landlock, features like cgroups, seccomp, AppArmor, Firejail and other sandboxing features go far beyond the traditional POSIX security model. Even parts of the ChromeOS security model are based on modern Linux sandboxing features, and don't rely on POSIX security. To address your Firefox example, I use these features to sandbox Firefox so that it runs in a container, and limit its ability to run code or make certain syscalls, and it's only allowed to touch its profile and a dedicated Downloads folder. D-Bus can't even reach it. > This has nothing to do with "stores" I didn't say anything about stores. It has everything to do with Apple, Microsoft and (slowly) Google forgoing OS-level security for centralized control of what can and cannot run on their operating systems. This is not just enforced with "stores", but with certificate systems like Apple's Notarization and Gatekeeper programs and Microsoft's certificate program. Instead of relying on the system to provide security, we're relying on Apple, Google and Microsoft to decide what we can run, or can't run, even though Apple is responsible for distributing 500 million copies of Xcodeghost[3], and Google's Play Store is the #1 vector for malware on Android[4]. [1] https://lwn.net/Articles/703876/ https://lwn.net/Articles/703876/ [2] https://lwn.net/Articles/700607/ https://lwn.net/Articles/700607/ [3] https://www.vice.com/en/article/n7bbmz/the-fortnite-trial-is-exposing-details-about-the-biggest-iphone-hack-of-all-time https://www.vice.com/en/article/n7bbmz/the-fortnite-trial-is... [4] https://www.zdnet.com/article/play-store-identified-as-main-distribution-vector-for-most-android-malware/ https://www.zdnet.com/article/play-store-identified-as-main-...
- jolux 5y ago
  > Instead of relying on the system to provide security, we're relying on Apple, Google and Microsoft to decide what we can run, or can't run This is highly misleading. System-level hardening is complementary to cryptographic trust, not a replacement forit. Hardening features do their best to prevent arbitrary malicious processes from controlling the system, and the certificate systems make it possible to revoke the ability of specific known-malicious authors to distribute software. In macOS, you can look at the entitlements system, sandboxing, and system integrity protection for examples of hardening. Not to mention, at least on macOS and Windows, all the certificate verification features can be turned off.
  - heavyset_go 5y ago
    > System-level hardening is complementary to cryptographic trust, not a replacement forit. Hardening features do their best to prevent arbitrary malicious processes from controlling the system, and the certificate systems make it possible to revoke the ability of specific known-malicious authors to distribute software. In macOS, you can look at the entitlements system, sandboxing, and system integrity protection for examples of hardening. I agree, however neither of these operating systems gives the user the level of control to address these concerns: > Do I want Firefox to have access to my Contacts? My Photos? Do I want Facebook to have that access? To all of them, or just ones that I select? Should my disk utility have the ability to send data over the network? My IDE? My IDE plugins? A system that implemented security that empowers users would allow you to say "I want my Email App to only access certain Contacts or certain Photos", allow you to supply dummy data to apps and give you better granularity. Instead, what we get from Google is a system whose security is convenient for advertisers first, and not users, so it doesn't offer that level of empowerment even though some AOSP forks do. You either give it all of your contacts or pictures or none of them. Making a secure system that also empowers users would mean that they and their partners can't collect user data. We're shown scary warnings about installing apps outside of the Play Store and are assured that Play Protect means that everything on the Play Store is secured. What we get from Apple is a security model that is convenient to their bottom line, so instead of addressing that user's needs, users are told they don't have to worry about their Email App doing anything bad with their contacts or photos because Apple vets apps and its developers. Like on Android, you either give the app all of your contacts or none. Making a secure system that also empowers users goes against their marketing that insists that their App Store and certificate racket are the only things keeping users private and safe.
Wowfunhappy 5y ago
> Do I want Firefox to have access to my Contacts? My Photos? Do I want Facebook to have that access? To all of them, or just ones that I select? Should my disk utility have the ability to send data over the network? My IDE? My IDE plugins? Wouldn't the POSIX way of handing this be to have Firefox run as its own "Firefox" user with different privileges?
- stouset 5y ago
  How do you then grant Firefox write access to your Downloads folder, read access to folders on the fly when you want to upload a file, “general area only” location information, access to the microphone and camera only during video conferencing, etc? You can do some of this with groups, but that’s difficult and runs into limitations pretty quick for even comparatively simple use-cases. And making a bunch of custom ab-hoc groups requires root access on top, when ideally a user should be able to manage fine-grained control without escalating their own privileges. Traditional POSIX file permissions are a huge blunt hammer that don’t scale well to the fine-grained type of access that things like iOS let you configure.
- alxlaz 5y ago
  It would, but you run into all sorts of impedance mismatch. For example, how do you revoke and grant access to your photos folder to some applications, on demand? The straightforward way (create groups for each important folder access class) blows up in terms of size very quickly, and group changes don't really happen on-the-fly, either. Things can get even murkier when it comes to device access, and you also have to deal with all sorts of caveats like suid binaries. You also don't have the API required to easily deal with any of this (e.g. no simple API to prompt the user for permission to access a path, no simple API to retry access until the user either grants access or denies it etc.).
- kaba0 5y ago
  POSIX permissions are way too crude to be properly functional. SELinux sort of solves that part of the equation with additional labels given to each file, but eg. Android only uses selinux for the base of the system. Modern security requires sandboxed applications with user-controllable permissions.

viraptor 5y ago

That's pretty much selinux. We don't have a nice ui for it, because what you described is actually pretty complicated to achieve. But it actually works. Today.

mikepurvis 5y ago
Socket/port activation in the init system tries to be a piece of this puzzle too, though obviously it's far from the whole story.

heavyset_go 5y ago

> Do I want Firefox to have access to my Contacts? My Photos? Do I want Facebook to have that access? To all of them, or just ones that I select? Should my disk utility have the ability to send data over the network? My IDE? My IDE plugins? Modern security on Linux is hardly dependent on the POSIX security model. Linux just got the Landlock feature[1] in the kernel[2] that does just this. Along with Landlock, features like cgroups, seccomp, AppArmor, Firejail and other sandboxing features go far beyond the traditional POSIX security model. Even parts of the ChromeOS security model are based on modern Linux sandboxing features, and don't rely on POSIX security. To address your Firefox example, I use these features to sandbox Firefox so that it runs in a container, and limit its ability to run code or make certain syscalls, and it's only allowed to touch its profile and a dedicated Downloads folder. D-Bus can't even reach it. > This has nothing to do with "stores" I didn't say anything about stores. It has everything to do with Apple, Microsoft and (slowly) Google forgoing OS-level security for centralized control of what can and cannot run on their operating systems. This is not just enforced with "stores", but with certificate systems like Apple's Notarization and Gatekeeper programs and Microsoft's certificate program. Instead of relying on the system to provide security, we're relying on Apple, Google and Microsoft to decide what we can run, or can't run, even though Apple is responsible for distributing 500 million copies of Xcodeghost[3], and Google's Play Store is the #1 vector for malware on Android[4]. [1] https://lwn.net/Articles/703876/ https://lwn.net/Articles/703876/ [2] https://lwn.net/Articles/700607/ https://lwn.net/Articles/700607/ [3] https://www.vice.com/en/article/n7bbmz/the-fortnite-trial-is-exposing-details-about-the-biggest-iphone-hack-of-all-time https://www.vice.com/en/article/n7bbmz/the-fortnite-trial-is... [4] https://www.zdnet.com/article/play-store-identified-as-main-distribution-vector-for-most-android-malware/ https://www.zdnet.com/article/play-store-identified-as-main-...

jolux 5y ago
> Instead of relying on the system to provide security, we're relying on Apple, Google and Microsoft to decide what we can run, or can't run This is highly misleading. System-level hardening is complementary to cryptographic trust, not a replacement forit. Hardening features do their best to prevent arbitrary malicious processes from controlling the system, and the certificate systems make it possible to revoke the ability of specific known-malicious authors to distribute software. In macOS, you can look at the entitlements system, sandboxing, and system integrity protection for examples of hardening. Not to mention, at least on macOS and Windows, all the certificate verification features can be turned off.
- heavyset_go 5y ago
  > System-level hardening is complementary to cryptographic trust, not a replacement forit. Hardening features do their best to prevent arbitrary malicious processes from controlling the system, and the certificate systems make it possible to revoke the ability of specific known-malicious authors to distribute software. In macOS, you can look at the entitlements system, sandboxing, and system integrity protection for examples of hardening. I agree, however neither of these operating systems gives the user the level of control to address these concerns: > Do I want Firefox to have access to my Contacts? My Photos? Do I want Facebook to have that access? To all of them, or just ones that I select? Should my disk utility have the ability to send data over the network? My IDE? My IDE plugins? A system that implemented security that empowers users would allow you to say "I want my Email App to only access certain Contacts or certain Photos", allow you to supply dummy data to apps and give you better granularity. Instead, what we get from Google is a system whose security is convenient for advertisers first, and not users, so it doesn't offer that level of empowerment even though some AOSP forks do. You either give it all of your contacts or pictures or none of them. Making a secure system that also empowers users would mean that they and their partners can't collect user data. We're shown scary warnings about installing apps outside of the Play Store and are assured that Play Protect means that everything on the Play Store is secured. What we get from Apple is a security model that is convenient to their bottom line, so instead of addressing that user's needs, users are told they don't have to worry about their Email App doing anything bad with their contacts or photos because Apple vets apps and its developers. Like on Android, you either give the app all of your contacts or none. Making a secure system that also empowers users goes against their marketing that insists that their App Store and certificate racket are the only things keeping users private and safe.

Wowfunhappy 5y ago

> Do I want Firefox to have access to my Contacts? My Photos? Do I want Facebook to have that access? To all of them, or just ones that I select? Should my disk utility have the ability to send data over the network? My IDE? My IDE plugins? Wouldn't the POSIX way of handing this be to have Firefox run as its own "Firefox" user with different privileges?

stouset 5y ago
How do you then grant Firefox write access to your Downloads folder, read access to folders on the fly when you want to upload a file, “general area only” location information, access to the microphone and camera only during video conferencing, etc? You can do some of this with groups, but that’s difficult and runs into limitations pretty quick for even comparatively simple use-cases. And making a bunch of custom ab-hoc groups requires root access on top, when ideally a user should be able to manage fine-grained control without escalating their own privileges. Traditional POSIX file permissions are a huge blunt hammer that don’t scale well to the fine-grained type of access that things like iOS let you configure.
alxlaz 5y ago
It would, but you run into all sorts of impedance mismatch. For example, how do you revoke and grant access to your photos folder to some applications, on demand? The straightforward way (create groups for each important folder access class) blows up in terms of size very quickly, and group changes don't really happen on-the-fly, either. Things can get even murkier when it comes to device access, and you also have to deal with all sorts of caveats like suid binaries. You also don't have the API required to easily deal with any of this (e.g. no simple API to prompt the user for permission to access a path, no simple API to retry access until the user either grants access or denies it etc.).
kaba0 5y ago
POSIX permissions are way too crude to be properly functional. SELinux sort of solves that part of the equation with additional labels given to each file, but eg. Android only uses selinux for the base of the system. Modern security requires sandboxed applications with user-controllable permissions.