5

I am running a Ubuntu Linux machine. When I run applications written by different vendors like Chrome and Firefox, I notice that they all are running with my uid. But if that's the case, any file they create on the file system will also be with the same uid. Then how in linux can two mutually untrusted apps keep their files secure from each other ?

  • using a ACL policy by app A may still allow app B to read A's files - through the user part of (user, group, other)
  • do apps need to use encryption to protect their data from each other ?
  • 4
    Why would they need to protect your data from you? – terdon Mar 29 '15 at 23:43
  • no from each other – Jake Mar 29 '15 at 23:44
  • 3
    Yes, but the UID is your UID. These files all belong to you. Applications don't have UIDs, what you choose to open with them is up to you and all apps run by you can see everything you can see. There aren't any files that belong to firefox or to chrome, all their files are blong to you. Certain applications do have their own files (apache for example) but those are created by their own user. – terdon Mar 29 '15 at 23:45
  • 1
    so there never is any scenario when an app needs to save some data on disk for use later, but due to data being sensitive, doesn't want other apps to read it ? – Jake Mar 29 '15 at 23:48
  • 5
    Not really. It's your data. Things always belong to users. In the rare cases where they belong to apps, those apps have an associated user account and it is that user who is the owner of the files. Firefox has no business writing data on my disk unless that data was somehow requested by me. – terdon Mar 29 '15 at 23:51
14

The literal answer is that there is no such thing as an untrusted application running under your account. If you want to run an untrusted application, run it under a different account or in a virtual machine.

Typical desktop operating systems such as Unix and Windows and typical mobile operating systems such as Android and iOS have different security models. Unix is a multiuser operating system, with mutually untrusted users. Applications are considered trusted: all the applications of a user run in the same security context. Services, on the other hand, are somewhat less trusted: they are typically executed under a dedicated account, to reduce the impact in case of a security vulnerability.

There are two major reasons why the Unix security model works this way:

  • A negative reason is history: when Unix was designed, applications came from a small set of programmers, and were backed by the reputation of the vendor or provided as source code or both. Backdoors were rarely feared in applications. Furthermore few applications communicated over the network, so there were relatively few opportunities to trigger and exploit vulnerabilities. Therefore there was no strong incentive to isolate applications from each other.
  • A positive reason is functionality: isolating applications makes a lot of things impossible. If each application has its own data area, that makes sharing data between applications difficult. On a typical Unix system, it is very common for the same data to be handled by multiple applications. This is especially true since Unix has no clear separation between “applications” and “the operating system”. A web browser is an application. Not being able to download a file into the directory of your choice, because the browser is confined to its own directory, is annoying. The program that displays menus and icons when you log in is also an application on the same footing. So are file managers, which by definition need access to all your files. So are the shells and other interpreters that execute scripts all over the place. When you print a document from a word processor, this might involve an application to convert the document to a printable format, and another application to send the data to the printer.

Although there are a lot more application authors now than 40 years ago, applications are still typically distributed through trusted channels, which carry a reputation indication. (This is markedly more true for Linux than for Windows, which is part of the reason why viruses are more common under Windows.) An application is found to have a backdoor would be promptly pulled from Linux software repositories.

Mobile operating systems were designed with different threats in mind. They were designed for single-user systems, but with applications coming from wholly untrusted sources.

Application isolation is starting to make its way onto desktop Unix systems. Some distributions run certain programs under security frameworks such as AppArmor or SELinux which restrict what the application can do. The cost of these security restrictions is that they sometimes make desirable uses impossible, for example preventing a restricted application from opening files in certain directories.

Encryption would be completely useless. Encryption only protects data in transit (over the network) or at rest (stored on a disk), it doesn't protect data on a live system — if subsystem A decrypts its data then it's up to the OS to prevent subsystem B to prevent access to the decrypted data, and thus it doesn't matter whether the data was decrypted by A or stored unencrypted. The operating system might encrypt data, but only to protect it in case the storage medium is stolen.

If you want to run code that you don't trust, the best thing to do is to run it in a virtual machine. Give the virtual machine access to only the files that the application needs (e.g. don't share your home directory).

See also Why do mobile apps have fine-grained permissions while desktop apps don't? and Why are apps for mobile devices more restrictive than for desktop?

| improve this answer | |
  • 3
    Also note that *nix is still fundamentally a programmer's operating system, rather than a user-oriented one. That is, people who use it are really expected to be writing some of their own programs, and so want to have access to just about everything on the system. – jamesqf Mar 30 '15 at 5:24
  • 4
    @jamesqf I strongly disagree with that statement. I know of plenty of non-programmers who use a Unix system — generally OSX, Ubuntu or Mint. Some of them do want to have access to everything even though they aren't programmers, others don't care but chose OSX because Mac, or chose Linux because freedom, or chose Linux because they saw their first computers in university in the 1990s and Unix was what the university had, or prefer OSX/Gnome/KDE/…'s interface to Windows's, or can't afford a computer that's powerful enough to run Windows, or … – Gilles 'SO- stop being evil' Mar 30 '15 at 10:35
  • 1
    Mind @jamesqf "fundamentally". *nix might have been designed initially as a developer's environment while today it has drifted towards a system environment for anyone. I don't find both of your statements are contradicting each other. – user86969 Mar 30 '15 at 12:13
  • @Gilles: By 'fundamentally', I meant that that is what *nix is designed to be. Not just developers, but people using things like Matlab/Octave, R, Perl, Python and so on to solve problems, tying them together with shell scripts &c. Of course some people, who really want Windoze but don't want to pay for it, have tried to dumb it down. Happily, the rest of us can still ignore them :-) – jamesqf Mar 31 '15 at 5:37
2

I like Gilles's answer but there's another aspect to consider:

A principle of unix is that each program is supposed to "do one thing well".

Programs weren't supposed to get so big and complicated that the user wouldn't be able to predict the result of running one. If a proper unix program touches a file, it's because you told it to touch that file. The idea that programs should do no more and no less than what they're told by the user kept them from interacting in ways the user didn't intend.

In an extreme example of the principle: one of the old unix mailreaders that almost nobody uses anymore, elm, asks for your approval before creating the directories that it will use to hold its config file (~/.elm/) and mail folders (~/Mail/). If you say no, it replies with

Very well, but you may run into difficulties later.

The opposite extreme was demonstrated by some program I tried to run recently (sorry I forget which one) which refused to start and didn't give any clue as to what was wrong. strace revealed that it wanted to create a directory called ~/.config/ and couldn't, because I had a regular file by that name. (I had once done a cp .config ~ from a kernel source tree, so I'd have a backup.) Apparently it's now considered reasonable to stomp on a very generic name in the user's home directory without notification (much less approval) or even minimal error checking.

Progress.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.