4 ms·

Most of the fiasco, as most fiascos are, is caused by ignorance and not understanding that PolicyKit gives this privilege only to people that are on the machine

by sgk284 17y ago

Most of the fiasco, as most fiascos are, is caused by ignorance and not understanding that PolicyKit gives this privilege only to people that are on the machine locally. These are the same people that could reboot the machine into single user mode and do whatever they want. One analogy involved the fact that we already allow users to automount devices and this is no different. I congratualte Fedora on questioning the status quo.

tshtf 17y ago
1) Right now I'm running Firefox locally in X11. If there is a code execution vulnerability in JPEG parsing, for example, the shellcode could just install a signed repo package with a root vulnerability. This potentially means the next Firefox vulnerability is remote root on FC12. 2) You don't have to be at the console to inject code to install arbitrary packages, but you do for mounting a drive. 3) There are good ideas behind policykit and packagekit, but the introduction was mishandled. No mention was made in the initial release notes of this new feature, and one could argue that the default policy isn't the best idea. However, having the ability to define more finely-grained policies should get two thumbs up.
- jerf 17y ago
  Yeah, I had to ponder your #1 there for a moment, but I think you're right. It is true that the local user is virtually by definition in possession of root capabilities (whether they know it or not), but that doesn't mean their user account is; the user account !=== the user from a security point of view. I think you've nailed why this is a bad idea. I manage my machines the same way; sure, I'm "root" and I tend to "su" around a lot, but I'm careful about what I do as root vs. what I do as my "main" user vs. what I may do as a throwaway user with virtually no privs (some Wine stuff gets run this way, for instance). Just because I-the-human am root all the time doesn't mean I want all my accounts to be root.
- ubernostrum 17y ago
  Except this is what bugs me about that huge fedora-dev thread: all the proposed attacks seem to begin by assuming the attacker is already in a position where they don't need this to own you. And it's really hard to read that thread without getting the impression that a lot of people are trying to take the security model and use cases of their companies' production servers and apply them to personal desktop systems.
  - dhimes 17y ago
    No, the real concern is that someone who doesn't understand the issue as well as "root" now can install software that has an exploit. Ex: I have a server in my office. My kids use it for this and that. One of them decides it's be cool to install the new TI->Ipod widget. Three days later I'm unknowingly hosting pirated movies. Edit: I made up the TI->ipod thing. Don't want to waste anybody's day!
    - ubernostrum 17y ago
      So, this raises the question of why you're running a desktop-oriented OS on a server. And as I said originally I think that's a big part of the problem: the server security use case and the desktop security use case are not the same, and far too much of the discussion has been based around the assumption that they are. On a server, the idea that a non-root user can install packages is terrifying, but on a desktop? Both the threat model and the use case are so wildly different that I don't think it's possible to make any meaningful comparison.
      - dhimes 17y ago
        So, this raises the question of why you're running a desktop-oriented OS on a server. As a staging area. The main reason for not using Fedora as a production server is not that it is desktop oriented but that it updates too frequently. Some of us (well, at least one of us) run(s) servers on our desktops as well.
        ubernostrum 17y ago
        And it certainly seems to be easy to change the policy settings to disallow people installing packages :) I guess I'm just looking at this from the POV of Fedora really trying to be an everyday desktop OS, where minimal pain in installing new software is a good thing and Fedora's policies for trusted repositories and signed packages help keep the risk minimal (yeah, somebody could sneak a backdoor into something in a Fedora repo, but if they can do that they're interested in more than owning your desktop machine).
- tedunangst 17y ago
  Your firefox exploit could also just wait until you type in your root password and sniff it then. But since the most interesting passwords a desktop user types are typed into the browser, and the exploit is already in the browser, I wonder just what it is you think your firefox exploit needs root to accomish.
sandGorgon 17y ago
Protect a user from himself. I manage IT for an accounting firm and I got a few ubuntu machines - they know how to use Synaptic (and know I need to give the password). However, it is highly unlikely any of them know how to drop to single-user mode and do "stuff". One of the things that companies like about Linux - is that it can be reasonably locked down against people who typically click attachments in mails, etc. ... not against hackers. I think this is the beginning of a new era of Linux viruses.

by sgk284 17y ago

tshtf 17y ago

1) Right now I'm running Firefox locally in X11. If there is a code execution vulnerability in JPEG parsing, for example, the shellcode could just install a signed repo package with a root vulnerability. This potentially means the next Firefox vulnerability is remote root on FC12. 2) You don't have to be at the console to inject code to install arbitrary packages, but you do for mounting a drive. 3) There are good ideas behind policykit and packagekit, but the introduction was mishandled. No mention was made in the initial release notes of this new feature, and one could argue that the default policy isn't the best idea. However, having the ability to define more finely-grained policies should get two thumbs up.

jerf 17y ago
Yeah, I had to ponder your #1 there for a moment, but I think you're right. It is true that the local user is virtually by definition in possession of root capabilities (whether they know it or not), but that doesn't mean their user account is; the user account !=== the user from a security point of view. I think you've nailed why this is a bad idea. I manage my machines the same way; sure, I'm "root" and I tend to "su" around a lot, but I'm careful about what I do as root vs. what I do as my "main" user vs. what I may do as a throwaway user with virtually no privs (some Wine stuff gets run this way, for instance). Just because I-the-human am root all the time doesn't mean I want all my accounts to be root.
ubernostrum 17y ago
Except this is what bugs me about that huge fedora-dev thread: all the proposed attacks seem to begin by assuming the attacker is already in a position where they don't need this to own you. And it's really hard to read that thread without getting the impression that a lot of people are trying to take the security model and use cases of their companies' production servers and apply them to personal desktop systems.
- dhimes 17y ago
  No, the real concern is that someone who doesn't understand the issue as well as "root" now can install software that has an exploit. Ex: I have a server in my office. My kids use it for this and that. One of them decides it's be cool to install the new TI->Ipod widget. Three days later I'm unknowingly hosting pirated movies. Edit: I made up the TI->ipod thing. Don't want to waste anybody's day!
  - ubernostrum 17y ago
    So, this raises the question of why you're running a desktop-oriented OS on a server. And as I said originally I think that's a big part of the problem: the server security use case and the desktop security use case are not the same, and far too much of the discussion has been based around the assumption that they are. On a server, the idea that a non-root user can install packages is terrifying, but on a desktop? Both the threat model and the use case are so wildly different that I don't think it's possible to make any meaningful comparison.
    - dhimes 17y ago
      So, this raises the question of why you're running a desktop-oriented OS on a server. As a staging area. The main reason for not using Fedora as a production server is not that it is desktop oriented but that it updates too frequently. Some of us (well, at least one of us) run(s) servers on our desktops as well.
      - ubernostrum 17y ago
        And it certainly seems to be easy to change the policy settings to disallow people installing packages :) I guess I'm just looking at this from the POV of Fedora really trying to be an everyday desktop OS, where minimal pain in installing new software is a good thing and Fedora's policies for trusted repositories and signed packages help keep the risk minimal (yeah, somebody could sneak a backdoor into something in a Fedora repo, but if they can do that they're interested in more than owning your desktop machine).
tedunangst 17y ago
Your firefox exploit could also just wait until you type in your root password and sniff it then. But since the most interesting passwords a desktop user types are typed into the browser, and the exploit is already in the browser, I wonder just what it is you think your firefox exploit needs root to accomish.

sandGorgon 17y ago

Protect a user from himself. I manage IT for an accounting firm and I got a few ubuntu machines - they know how to use Synaptic (and know I need to give the password). However, it is highly unlikely any of them know how to drop to single-user mode and do "stuff". One of the things that companies like about Linux - is that it can be reasonably locked down against people who typically click attachments in mails, etc. ... not against hackers. I think this is the beginning of a new era of Linux viruses.