3 ms·

Well, there's macOS which has a very capabilities-based design (Documents folder? Pictures folder? Contacts? Desktop? Screen recording?) but most people just se

Well, there's macOS which has a very capabilities-based design (Documents folder? Pictures folder? Contacts? Desktop? Screen recording?) but most people just see it as annoying.

hot_gril 3y ago
Eh, those are just folders. iOS has proper app sandboxing, but it could be taken a step further with VMs.
- gjsman-1000 3y ago
  Ah... No? https://support.apple.com/en-asia/guide/mac-help/mchl211c911f/mac https://support.apple.com/en-asia/guide/mac-help/mchl211c911... https://youtu.be/sxgYBi-PuGI?t=298 https://youtu.be/sxgYBi-PuGI?t=298
  - hot_gril 3y ago
    Doesn't seem bulletproof. I made a .sh script that touches a file in each of those dirs and ran it. It didn't ask for permission. Privacy settings don't have full disk access or individual file access granted to iTerm2, in case that matters. Edit: Nothing has full disk access either. I even see bash listed as explicitly not having access.
    - gjsman-1000 3y ago
      That's because the Terminal app has an exemption for Full Disk Access, so as to not break anything. Edit: OK, iTerm2, not sure what's going on there.
      - hot_gril 3y ago
        Yeah, maybe something is weird about every Mac setup I've used, but I've barely even noticed these restrictions. Pretty sure CLIs and shell scripts in general have full disk access by default. Almost seems like the restrictions require some cooperation from the apps, idk. Besides disk access, there are all sorts of other ways I don't trust random native apps on my Mac. At least camera access is locked down now (I think).
        mike_hearn 3y ago
        They don't. But you almost certainly click through the prompt the first time you cd into Downloads without noticing. Prompt blindness is real.
        hot_gril 3y ago
        I just reset all folder access perms to "no" and killed both Terminal and iTerm. Tested in Terminal, and it did protect the downloads, desktop, and photos library folders, but not any of the other ones in the home dir (pictures etc) or the Music lib. Weirdly, iTerm did ask for permission when I cd'd to ~/Desktop, and I said no, but it was still able to cd and edit/view/delete anything inside; the only thing I can't do is ls. BUT in ~/Downloads, I can only mess with files created within iTerm, not pre-existing ones. At this point I double-checked iTerm still doesn't have access to either (or full disk access) in my sysprefs, restarted iTerm, and reproduced this. So yes it still feels like Terminal is willingly complying while iTerm is not totally, or something is just broken. And even if both were actually enforced fully, the permissions carry over to anything you run in there, and they don't protect very many things to begin with. Like, it can delete my entire Music lib without permissions either way. Ventura 13.5.2, 2019 Intel MBP
        mike_hearn 3y ago
        macOS does a lot of automatic tracking of things to try and reduce the impact of the security system. There's a system called "bookmarks" which lets apps have access to things they created even in sandbox-isolated locations, it might be related to that. I think terminal users aren't really in-scope for macOS security.
        hot_gril 3y ago
        So maybe because in the past I granted iTerm access to Desktop, it still has access to everything inside even after I've disabled it. I tried making a new file outside of iTerm just now, and iTerm can still read it, so it seems directory-level. iTerm is third-party software like anything else. Wonder if it got an exemption. Also, TextEdit evidently has access to everything without asking, so it's not just a terminal thing. Idk what's happening exactly, but I don't trust this sandboxing.
      - astrange 3y ago
        Terminal doesn't come with full disk access; you'll get prompts if you look inside eg app containers. But people tend to approve it the first time that happens. There are also data vaults, which you cannot get around without turning off SIP.
mikewarot 3y ago
MacOS doesn't do capability based security, it does permission flags instead.[1] A permission flag is the clunky thing we all have learned to hate that smartphones do, instead of the elegance that is capability based security.[2] Let's say you want to buy an ice cream cone, and pay for it. Think of permission flags as signing a "Power of Attorney" letter, and handing that over to Dairy Queen. Every time you get a cone, they just take the money out of your account. But they could also sell your house. You can't limit the side effects of the permission you give, it's all or nothing. On the other hand, capability based security is like taking a $5 capability out of your wallet (in the US, a piece of paper with Lincoln on it), and paying directly for that transaction, one time, at the time it is needed. The most you can lose is that $5. You're not risking your home, just to get ice cream. The OS market is deranged. Capability based security is something that's been required since persistent internet connections became a thing. Clearly blaming everything else, the users, admins, programmers, compilers, language design, hasn't worked. [1] https://support.apple.com/en-asia/guide/mac-help/mchl211c911f/mac https://support.apple.com/en-asia/guide/mac-help/mchl211c911... [2] https://en.wikipedia.org/wiki/Capability-based_security https://en.wikipedia.org/wiki/Capability-based_security
- astrange 3y ago
  This is not a useful distinction because it'd be the same UI. If you grant an app a more specific capability, that just means a more specific permissions dialog. If you don't change the dialogs, the capabilities are going to be the same access it is now. I don't think users want to deal with much more fine grained dialogs. And it does have more specific capabilities called "security-scoped bookmarks".
- jamwil 3y ago
  What would this look like in use? A permission dialog for every interaction? If you bury the user in those, it doesn’t take long before they just mindlessly smash buttons to make the pain stop. The infosec community never read The Boy Who Cried Wolf.
  - mikewarot 3y ago
    >What would this look like in use? It would look almost exactly the same thing you already see. Instead of "file open" actually just being a suggestion to the application, the OS would actual enforce the permissions so that the application couldn't do anything else. The usability of such a system wouldn't really ever take a hit. It certainly wouldn't result in excess permission dialogs. You don't see permission dialogs every time you take cash out of your wallet, or when you turn on a light switch. The infosec community is weird, and I'm not part of it. I strongly disagree with them these days.

Well, there's macOS which has a very capabilities-based design (Documents folder? Pictures folder? Contacts? Desktop? Screen recording?) but most people just see it as annoying.

hot_gril 3y ago

Eh, those are just folders. iOS has proper app sandboxing, but it could be taken a step further with VMs.

gjsman-1000 3y ago
Ah... No? https://support.apple.com/en-asia/guide/mac-help/mchl211c911f/mac https://support.apple.com/en-asia/guide/mac-help/mchl211c911... https://youtu.be/sxgYBi-PuGI?t=298 https://youtu.be/sxgYBi-PuGI?t=298
- hot_gril 3y ago
  Doesn't seem bulletproof. I made a .sh script that touches a file in each of those dirs and ran it. It didn't ask for permission. Privacy settings don't have full disk access or individual file access granted to iTerm2, in case that matters. Edit: Nothing has full disk access either. I even see bash listed as explicitly not having access.
  - gjsman-1000 3y ago
    That's because the Terminal app has an exemption for Full Disk Access, so as to not break anything. Edit: OK, iTerm2, not sure what's going on there.
    - hot_gril 3y ago
      Yeah, maybe something is weird about every Mac setup I've used, but I've barely even noticed these restrictions. Pretty sure CLIs and shell scripts in general have full disk access by default. Almost seems like the restrictions require some cooperation from the apps, idk. Besides disk access, there are all sorts of other ways I don't trust random native apps on my Mac. At least camera access is locked down now (I think).
      - mike_hearn 3y ago
        They don't. But you almost certainly click through the prompt the first time you cd into Downloads without noticing. Prompt blindness is real.
        hot_gril 3y ago
        I just reset all folder access perms to "no" and killed both Terminal and iTerm. Tested in Terminal, and it did protect the downloads, desktop, and photos library folders, but not any of the other ones in the home dir (pictures etc) or the Music lib. Weirdly, iTerm did ask for permission when I cd'd to ~/Desktop, and I said no, but it was still able to cd and edit/view/delete anything inside; the only thing I can't do is ls. BUT in ~/Downloads, I can only mess with files created within iTerm, not pre-existing ones. At this point I double-checked iTerm still doesn't have access to either (or full disk access) in my sysprefs, restarted iTerm, and reproduced this. So yes it still feels like Terminal is willingly complying while iTerm is not totally, or something is just broken. And even if both were actually enforced fully, the permissions carry over to anything you run in there, and they don't protect very many things to begin with. Like, it can delete my entire Music lib without permissions either way. Ventura 13.5.2, 2019 Intel MBP
        mike_hearn 3y ago
        macOS does a lot of automatic tracking of things to try and reduce the impact of the security system. There's a system called "bookmarks" which lets apps have access to things they created even in sandbox-isolated locations, it might be related to that. I think terminal users aren't really in-scope for macOS security.
        hot_gril 3y ago
        So maybe because in the past I granted iTerm access to Desktop, it still has access to everything inside even after I've disabled it. I tried making a new file outside of iTerm just now, and iTerm can still read it, so it seems directory-level. iTerm is third-party software like anything else. Wonder if it got an exemption. Also, TextEdit evidently has access to everything without asking, so it's not just a terminal thing. Idk what's happening exactly, but I don't trust this sandboxing.
    - astrange 3y ago
      Terminal doesn't come with full disk access; you'll get prompts if you look inside eg app containers. But people tend to approve it the first time that happens. There are also data vaults, which you cannot get around without turning off SIP.

mikewarot 3y ago

MacOS doesn't do capability based security, it does permission flags instead.[1] A permission flag is the clunky thing we all have learned to hate that smartphones do, instead of the elegance that is capability based security.[2] Let's say you want to buy an ice cream cone, and pay for it. Think of permission flags as signing a "Power of Attorney" letter, and handing that over to Dairy Queen. Every time you get a cone, they just take the money out of your account. But they could also sell your house. You can't limit the side effects of the permission you give, it's all or nothing. On the other hand, capability based security is like taking a $5 capability out of your wallet (in the US, a piece of paper with Lincoln on it), and paying directly for that transaction, one time, at the time it is needed. The most you can lose is that $5. You're not risking your home, just to get ice cream. The OS market is deranged. Capability based security is something that's been required since persistent internet connections became a thing. Clearly blaming everything else, the users, admins, programmers, compilers, language design, hasn't worked. [1] https://support.apple.com/en-asia/guide/mac-help/mchl211c911f/mac https://support.apple.com/en-asia/guide/mac-help/mchl211c911... [2] https://en.wikipedia.org/wiki/Capability-based_security https://en.wikipedia.org/wiki/Capability-based_security

astrange 3y ago
This is not a useful distinction because it'd be the same UI. If you grant an app a more specific capability, that just means a more specific permissions dialog. If you don't change the dialogs, the capabilities are going to be the same access it is now. I don't think users want to deal with much more fine grained dialogs. And it does have more specific capabilities called "security-scoped bookmarks".
jamwil 3y ago
What would this look like in use? A permission dialog for every interaction? If you bury the user in those, it doesn’t take long before they just mindlessly smash buttons to make the pain stop. The infosec community never read The Boy Who Cried Wolf.
- mikewarot 3y ago
  >What would this look like in use? It would look almost exactly the same thing you already see. Instead of "file open" actually just being a suggestion to the application, the OS would actual enforce the permissions so that the application couldn't do anything else. The usability of such a system wouldn't really ever take a hit. It certainly wouldn't result in excess permission dialogs. You don't see permission dialogs every time you take cash out of your wallet, or when you turn on a light switch. The infosec community is weird, and I'm not part of it. I strongly disagree with them these days.