2

Let's say I have an application which has plugins, daemons, etc.

Now It has to save its settings and plugins settings as well as too. Most of all applications use users home folder for it but it is not secure. Something (a bad user, a hacker, a virus etc.) can delete those settings. Gsettings store them in binary database in user folder, KDE save them in INI format in users home folder but these options are not secure still because something can delete them easily.Or am I wrong? How else can I secure it?

Storing them as root or another user is not an option too as you know you have to grant permission for every little change you make which is very annoying.

  • 4
    What is the problem with the settings being erased? If the configuration directory is not present in the user homedir, the application should just consider it's the first time it's used. Actually, this is the desired behavior for many users, including me. When an application stops working because of bad settings or plugins combinations, I purge the configuration directory and start all over. – lgeorget Oct 8 '14 at 11:02
  • @lgeorget I agree with that too but as I said some malware may do it too. It can delete it everytime its created and another thing is the thing is I really would not like to lose my settings If it is not neccesary. – byECHO Oct 8 '14 at 11:05
  • Then, you should back them up on an external storage. There's nothing which can prevent a malware executing with the same privileges as yours to corrupt or delete your files. And as you wrote, storing users' preferences in system directories is hardly an option if users cannot change them when they want to. – lgeorget Oct 8 '14 at 11:08
  • You could use SELinux to limit what applications, including malware, can do, but it's not very easy to setup. – Cristian Ciupitu Oct 9 '14 at 0:31
1

Unfortunately these are your options:

  • User's home directory
  • /etc
  • Some other designated location on the system

There is no magical place you can save your data where it will be impervious to a potential attack. This is why must follow good security practices on the entire machine and make use of a firewall and not install software that hasn't been properly vetted prior.

There have been very few viruses in comparison to Windows and OSX, partly due to the design on Unix/Linux, and partly due to these OSes smaller deployments.

| improve this answer | |
  • So then I should use /etc for default ones, user directory for later changes and I should make system itself secure to prevent malware get in. Right? – byECHO Oct 8 '14 at 11:28
  • @byECHO - yes, that is one approach, use /etc for defaults, use /home for overrides/customizations, and always make your systems as secure as you can.. – slm Oct 8 '14 at 11:36
1

Save the settings in the user's home directory.

Yes, a malware running as the user will be able to delete them. So? A malware that infects the user's account can do whatever your application can do. The only way to hide something from malware is to run with some privilege that the malware doesn't have. This would require the user to give your application elevated privileges. If your application gets elevated privileges, why not every application? So the malware would get the same privileges anyway.

You can only lose by trying to put settings in a non-standard location. If the user cares, they'll back up their home directory. If the user backs up their home directory, they'd expect all their settings to be saved. If they restore their home directory and your settings aren't there, you'll have angry users and it'll be your fault.

Put the settings where the user expects them, in the home directory. That's the safest place.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.