4 ms·

Except this is what bugs me about that huge fedora-dev thread: all the proposed attacks seem to begin by assuming the attacker is already in a position where th

Except this is what bugs me about that huge fedora-dev thread: all the proposed attacks seem to begin by assuming the attacker is already in a position where they don't need this to own you. And it's really hard to read that thread without getting the impression that a lot of people are trying to take the security model and use cases of their companies' production servers and apply them to personal desktop systems.

dhimes 17y ago
No, the real concern is that someone who doesn't understand the issue as well as "root" now can install software that has an exploit. Ex: I have a server in my office. My kids use it for this and that. One of them decides it's be cool to install the new TI->Ipod widget. Three days later I'm unknowingly hosting pirated movies. Edit: I made up the TI->ipod thing. Don't want to waste anybody's day!
- ubernostrum 17y ago
  So, this raises the question of why you're running a desktop-oriented OS on a server. And as I said originally I think that's a big part of the problem: the server security use case and the desktop security use case are not the same, and far too much of the discussion has been based around the assumption that they are. On a server, the idea that a non-root user can install packages is terrifying, but on a desktop? Both the threat model and the use case are so wildly different that I don't think it's possible to make any meaningful comparison.
  - dhimes 17y ago
    So, this raises the question of why you're running a desktop-oriented OS on a server. As a staging area. The main reason for not using Fedora as a production server is not that it is desktop oriented but that it updates too frequently. Some of us (well, at least one of us) run(s) servers on our desktops as well.
    - ubernostrum 17y ago
      And it certainly seems to be easy to change the policy settings to disallow people installing packages :) I guess I'm just looking at this from the POV of Fedora really trying to be an everyday desktop OS, where minimal pain in installing new software is a good thing and Fedora's policies for trusted repositories and signed packages help keep the risk minimal (yeah, somebody could sneak a backdoor into something in a Fedora repo, but if they can do that they're interested in more than owning your desktop machine).
      - dhimes 17y ago
        The way to success as an everyday OS isn't through bad policy, it's through education and clarity. Put in the right policies but make them easy for the end user to understand and change. Commands like "restorecon" suck (as an everyday OS). But if, attached to a mv (or its gui equivalent) was a message: "the default permissions for this directory are to make the file available to X, Y, and Z. Would you like to make these files available, too?", it would work. Even better is a mv -yes (& gui equivalent) which does it automatically.

dhimes 17y ago

No, the real concern is that someone who doesn't understand the issue as well as "root" now can install software that has an exploit. Ex: I have a server in my office. My kids use it for this and that. One of them decides it's be cool to install the new TI->Ipod widget. Three days later I'm unknowingly hosting pirated movies. Edit: I made up the TI->ipod thing. Don't want to waste anybody's day!

ubernostrum 17y ago
So, this raises the question of why you're running a desktop-oriented OS on a server. And as I said originally I think that's a big part of the problem: the server security use case and the desktop security use case are not the same, and far too much of the discussion has been based around the assumption that they are. On a server, the idea that a non-root user can install packages is terrifying, but on a desktop? Both the threat model and the use case are so wildly different that I don't think it's possible to make any meaningful comparison.
- dhimes 17y ago
  So, this raises the question of why you're running a desktop-oriented OS on a server. As a staging area. The main reason for not using Fedora as a production server is not that it is desktop oriented but that it updates too frequently. Some of us (well, at least one of us) run(s) servers on our desktops as well.
  - ubernostrum 17y ago
    And it certainly seems to be easy to change the policy settings to disallow people installing packages :) I guess I'm just looking at this from the POV of Fedora really trying to be an everyday desktop OS, where minimal pain in installing new software is a good thing and Fedora's policies for trusted repositories and signed packages help keep the risk minimal (yeah, somebody could sneak a backdoor into something in a Fedora repo, but if they can do that they're interested in more than owning your desktop machine).
    - dhimes 17y ago
      The way to success as an everyday OS isn't through bad policy, it's through education and clarity. Put in the right policies but make them easy for the end user to understand and change. Commands like "restorecon" suck (as an everyday OS). But if, attached to a mv (or its gui equivalent) was a message: "the default permissions for this directory are to make the file available to X, Y, and Z. Would you like to make these files available, too?", it would work. Even better is a mv -yes (& gui equivalent) which does it automatically.