Flatpak – a security nightmare

Re:Flatpak – a security nightmare by gmueckl on Tuesday October 09, 2018 @06:25PM (#18180344)

This highlights a conceptual dilemma with access rights in file systems: if an image manipulation software wants to open .bashrc, this is potentially suspicious. But for a text editor this is probably ok. Likewise, a text editor that reads a binary executable is probably a little bit fishy. But a unzip program might so that for a valid reason (e.g. ZIP archive appended at end of program, a common thing for installers). How can we distinguish between those cases?

[ Parent | on HN ]

Re:Flatpak – a security nightmare by briffle on Tuesday October 09, 2018 @06:27PM (#18180358)

This is pretty much the whole point of SELinux (and probably AppArmour)

[ Parent | on HN ]

Re:Flatpak – a security nightmare by geofft on Tuesday October 09, 2018 @06:43PM (#18180447)

How does SELinux or AppArmor distinguish between those cases? More interestingly, how can it tell that VSCode spontaneously editing .bashrc is bad, but doing so in response to user input is good?

(There are capability-based systems that permit distinguishing between these cases, but to my knowledge SELinux and AppArmor don't support this.)

[ Parent | on HN ]

Re:Flatpak – a security nightmare by cyphar on Tuesday October 09, 2018 @08:21PM (#18180943)

SELinux and AppArmor would allow you to specify that your text editor is allowed to edit .bashrc, but some random other program isn't.

But I agree with you that this is not really a useful security feature -- you'd want something where a program has to be explicitly granted permission rather than some programs being able to do things that others can't (because then any attacker will just spawn "vi -c 'bad payload'" to get around the restriction).

[ Parent | on HN ]

Re:Flatpak – a security nightmare by jniedrauer on Wednesday October 10, 2018 @01:56AM (#18182353)

Directory trees and files have a security context (etc_t, user_home_t, and so on), and there are rules governing which application contexts are allowed to access or modify which security contexts. It doesn't cover every edge case, and it can be frustrating to deal with things like local docker development. But the added safety is absolutely worth it to me.

[ Parent | on HN ]

Re:Flatpak – a security nightmare by Conan_Kudo on Tuesday October 09, 2018 @07:40PM (#18180744)

SELinux labels users and domain transitions, so it's "technically" possible to do so, but I see that incredibly rarely.

I don't think AppArmor has such a facility. It wouldn't make sense, given that AppArmor doesn't know these things like SELinux would.

[ Parent | on HN ]

Re:Flatpak – a security nightmare by segmondy on Tuesday October 09, 2018 @08:19PM (#18180932)

I'll just make a file link to .bashrc and call it /tmp/foo.png, what are you going to do? Not open links? Check if the file links to .bashrc?

If an image manipulation software wants to open .bashrc, allow it. If it has permission to write to one, so be it. If .bashrc is such a security nightmare, then perhaps the issue is that programs can write to it. Remove the write permission. Perhaps a security model where restoring permission asks for password.

[ Parent | on HN ]

Re:Flatpak – a security nightmare by int_19h on Wednesday October 10, 2018 @09:29PM (#18190400)

> Check if the file links to .bashrc?

That would seem to be the obvious right choice. What's the problem with it?

[ Parent | on HN ]

Re:Flatpak – a security nightmare by MayeulC on Wednesday October 10, 2018 @09:33AM (#18184648)

Mmm... This is a random idea, but maybe this could be supported trough filtering files by mimetype.

Gimp would only get access to image/* (not sure it needs something else? Adapt in the case it does). Of course, this requires adjusting the current development workflow (maintain a list of filetypes needed, for example).

[ Parent | on HN ]