4 ms·

The real problem are the web applications and encasulated web applications (electron, etc) which download their executable code entirely anew each time you run

The real problem are the web applications and encasulated web applications (electron, etc) which download their executable code entirely anew each time you run them. They can just add something like require('fs').readFileSync(process.env.HOME + '/.ssh/id_rsa').toString() and send this to their servers, and you won't even notice that (since it doesn't require an update on client because the client is just a browser with full permissions that loads obfuscated code from their servers every time you launch it). An installed binary is much more verifiable and secure and trustworthy.

kccqzy 2y ago
A long time ago I had this (not very original) idea that software would be installed in /usr/bin and it would be mounted as a read-only file system. All other mount points that aren't read only like /tmp or /home ignore execute bit for all files. These days I don't think that's much of an improvement. And the problem is not just JavaScript. Python apps can also just download new code from the server and execute them. You can even do it in bash. The real problem is the fact that software that can be used locally needs to connect the vendor's server in the first place. The other real problem is that by and large desktop software is not sufficiently sandboxed and does not have effective security policy (like SELinux) to restrict their permission.
- ninkendo 2y ago
  If an app has root (which it would need to write to /usr), then mount -o remount,rw /usr Can defeat that pretty trivially. Probably why nobody really bothers with it. /usr (and root access in general) is such a distraction from the real issue though, which is that all the stuff I care about is accessible under my account. My browser data, photos, etc etc… if a malicious app isn’t sandboxed and is running as me, it’s game over. Stopping it from writing to /usr (or other places outside my homedir) is basically meaningless.
- superkuh 2y ago
  Setting all the exectuable and lib files in an application's directory as immutable might work: chattr +i.

kccqzy 2y ago

A long time ago I had this (not very original) idea that software would be installed in /usr/bin and it would be mounted as a read-only file system. All other mount points that aren't read only like /tmp or /home ignore execute bit for all files. These days I don't think that's much of an improvement. And the problem is not just JavaScript. Python apps can also just download new code from the server and execute them. You can even do it in bash. The real problem is the fact that software that can be used locally needs to connect the vendor's server in the first place. The other real problem is that by and large desktop software is not sufficiently sandboxed and does not have effective security policy (like SELinux) to restrict their permission.

ninkendo 2y ago
If an app has root (which it would need to write to /usr), then mount -o remount,rw /usr Can defeat that pretty trivially. Probably why nobody really bothers with it. /usr (and root access in general) is such a distraction from the real issue though, which is that all the stuff I care about is accessible under my account. My browser data, photos, etc etc… if a malicious app isn’t sandboxed and is running as me, it’s game over. Stopping it from writing to /usr (or other places outside my homedir) is basically meaningless.
superkuh 2y ago
Setting all the exectuable and lib files in an application's directory as immutable might work: chattr +i.