4 ms·

The problem is that in a sense it is just some random Qt/Gtk window. I have recently written my own PolKit agent. It runs purely in userspace without any specia

The problem is that in a sense it is just some random Qt/Gtk window. I have recently written my own PolKit agent. It runs purely in userspace without any special privileges. An attacker could kill your legitimate PolKit agent, register itself as your agent, even act as one, and also steal your password the next time you do actually authenticate something. In that sense a PIN linking the command line to the agent window doesn't save you. I agree this situation needs improving, the problem just runs much, much deeper. On the other hand: if an attacker placed a modified sudo that steals your password in ~/.local/bin, it would also be Game Over. Much of the current security model breaks as soon as the attacker has code execution. EDIT: I'd also like to highlight this: > or the window should be able to use some restricted window manager feature (like Windows' fullscreen greying out thing) to prove Your Wayland compositor also runs in userspace. Even if it is supposed to check that some calls come from euid 0, an attacker may be able to circumvent them if the attacker runs in the same context as the compositor. Again, the security problem runs very deep.

kaba0 3y ago
As much as I love linux, it is very painful to accept the state of “security”, this is beyond criminal. Especially that many people just put their head into the sand. The age-old xkcd about linux being secure only about your video card driver is still true to this age, with no clear sign of improvement. Also, frankly I don’t understand why there is no more cross-pollination between android and linux userspace - the former has actually solved this issue properly. I’m afraid the answer is that “it is not written in c”.
- tredre3 3y ago
  > I’m afraid the answer is that “it is not written in c”. I don't think it has anything to do with it. Android's security comes from design, not language. Each application runs under its own UID and not all applications can draw arbitrary content on your screen, for example. Those things could be on the Linux Desktop. And maybe flatpak will bring it to us. But for now I can already hear the screeching about "freedom" and "the Unix philosophy".
  - hulitu 3y ago
    > Android's security comes from design "This application requires storage permission. Grant ?" Yes. Comes from design. /s
    - KETHERCORTEX 3y ago
      Still better than Flatpak's "install time permissions".

kaba0 3y ago

As much as I love linux, it is very painful to accept the state of “security”, this is beyond criminal. Especially that many people just put their head into the sand. The age-old xkcd about linux being secure only about your video card driver is still true to this age, with no clear sign of improvement. Also, frankly I don’t understand why there is no more cross-pollination between android and linux userspace - the former has actually solved this issue properly. I’m afraid the answer is that “it is not written in c”.

tredre3 3y ago
> I’m afraid the answer is that “it is not written in c”. I don't think it has anything to do with it. Android's security comes from design, not language. Each application runs under its own UID and not all applications can draw arbitrary content on your screen, for example. Those things could be on the Linux Desktop. And maybe flatpak will bring it to us. But for now I can already hear the screeching about "freedom" and "the Unix philosophy".
- hulitu 3y ago
  > Android's security comes from design "This application requires storage permission. Grant ?" Yes. Comes from design. /s
  - KETHERCORTEX 3y ago
    Still better than Flatpak's "install time permissions".