26

When I install a program like GIMP or LibreOffice on Linux I'm never asked about permissions. By installing a program on Ubuntu, am I explicitly giving that program full permission to read/write anywhere on my drive and full access to the internet?

Theoretically, could GIMP read or delete any directory on my drive, not requiring a sudo-type password?

I'm only curious if it's technically possible, not if it's likely or not. Of course, I know it's not likely.

  • 26
    Obligatory XKCD: xkcd.com/1200 – Andrea Lazzarotto Mar 26 '18 at 20:09
  • 10
    Because Linux's security model dates from before anyone thought of doing that. In fact it dates from before the Internet - when your biggest threat was other people using the same computer. – user253751 Mar 26 '18 at 22:40
  • 2
    In part because a good many of the people who use *nix don't "install" programs, they either compile them from source, or write them themselves. So imagine if you had to go through the "permissions" rigamarole for every simple little shell script you wrote: wouldn't that be a massive waste of time? – jamesqf Mar 27 '18 at 4:02
  • 4
    I don't buy this line of reasoning though, "the code is open source, you can review it, and compile it yourself!". All these statements are true but that doesn't mean I am going to be able to review every line of code I run, and even if I did, or a team of people did, or the whole world did, that in no way means you'll spot malicous or bad code that negatively impact your computer. But thanks for the input, I see how it could become a major pain and I've discovered ways around it now. – stackinator Mar 27 '18 at 12:10
  • 4
31

There are two things here:

  • when you install a program by standard means (system installer such as apt/apt-get on Ubuntu) it is usually installed in some directory where it is available to all users (/usr/bin...). This directory requires privileges to be written to so you need special privileges during installation.

  • when you use the program, it runs with your user id and can only read or write where programs executed with your id are allowed to read or write. In the case of Gimp, you will discover for instance that you cannot edit standard resources such as brushes because they are in the shared /usr/share/gimp/ and that you have to copy them first. This also shows in Edit>Preferences>Folders where most folders come in pairs, a system one which is read-only and a user one that can be written to.

  • 17
    Once the program is installed, how it was installed becomes irrelevant. The only thing that counts is under which userid it runs ((in other words, who is using it). Then it assumes the same access rights as all other programs run by the same user. – xenoid Mar 26 '18 at 17:45
  • 3
    @xenoid Unless the program is installed owned by root and with setuid bit on. In that case, the program runs as root, despite being used by someone else. – Monty Harder Mar 26 '18 at 20:34
  • 2
    Yes, all 18 of them: mount/umount/ping/sudo... – xenoid Mar 26 '18 at 21:44
  • 2
    @xenoid, I think the important bit there is that installing a package doesn't explicitly ask you for permission to install a setuid binary. Instead, whatever is in the package gets installed, and you just have to "know" some other way if there's privileged programs involved. You're completely reliant on the packager to make sure the package matches the documentation and is otherwise safe etc, the package manager utility does nothing to help you there. – ilkkachu Mar 27 '18 at 9:02
  • 3
    Yes, so nothing new, this is why there are repositories... Even without the setuid bit and installed software can do plenty of other nasty things such as rm -rf ~/. If you install from other sources you have to be careful (or install from source, after a code inspection). – xenoid Mar 27 '18 at 9:50
23

By installing a program on Ubuntu am I explicitly giving that program full permission to read/write anywhere on my drive and full access to the internet?

Yes, if you use sudo or the equivalent, you are giving the installer full permission to read/write anywhere on your drive. This is mostly the same thing. There is also a flag that the installer can set, called setuid, which will make the program have full permissions after install too.

Even if we ignore the installer and if the program is not setuid (it's very rare for programs to use setuid), when you run the program it has full access to anything your account can access. For example, if you're logged into your online banking, it could hypothetically send all your funds to Nigeria.

Why no permissions like Android or iOS?

The security model - that means the way the security system is designed - in Linux is very old. It's inherited from Unix, which dates back to the 1960s. Back then, there was no Internet, and most people in a department used the same computer. Most of your programs came from big companies that were trusted. So the security system was designed to protect users from each other, not to protect users from the programs they run.

Nowadays it is fairly outdated. Android is based on Linux, but it works by creating a separate "user account" for every app, instead of for every user. I don't know what iOS uses. Efforts like Flatpak are currently trying to bring the same sort of thing to the Linux desktop.

  • 2
    This is actually one argument for running potentially exploitable code as a separate non-privileged user and hoping there is no privilege escalation vulnerability in the OS. Or Docker. – Willtech Mar 27 '18 at 10:55
  • @immibis Android uses the Linux kernel and an ext FS. It doesn't share any other similarities afaik. Don't conflate Linux and UNIX-like (or GNU/Linux). (At least you didn't call FreeBSD "Linux"..) – wizzwizz4 Mar 27 '18 at 16:19
  • 1
    @wizzwizz4 Linux is a kernel, Android uses the kernel called Linux, I'm not sure what your point is. – user253751 Mar 27 '18 at 22:05
  • @Willtech It technically does work as a security measure, but it's pretty inconvenient. You generally want apps to be able to access your files, after all. But only the files you told them to access. – user253751 Mar 28 '18 at 3:28
  • @immibis The permissions aren't implemented in the kernel, so it's misleading to imply that Android is based on a system that includes the permission model. (IIirc the kernel enforces some of the permissions though..) – wizzwizz4 Mar 28 '18 at 6:34
9

What you want is being provided by Flatpack apps. These are very much the equivalent of iOS, Android, or Windows Store apps.

I haven't used them so I don't know if they've implemented the GUI yet, to see the permissions required by each app when it is installed.

https://blogs.gnome.org/alexl/2017/01/20/the-flatpak-security-model-part-2-who-needs-sandboxing-anyway/

Every flatpak application contains a manifest, called metadata. This file describes the details of the application, like its identity (app-id) and what runtime it uses. It also lists the permissions that the application requires.

By default, once installed, an application gets all the permissions that it requested. However, you can override the permissions each time you call flatpak run or globally on a per-application basis by using flatpak override (see manpages for flatpak-run and flatpak-override for details). The handling of application permissions are currently somewhat hidden in the interface, but the long term plan is to show permissions during installation and make it easier to override them.

I also haven't used Ubuntu's alternative, Snappy, to know if it provides such a feature visible in the GUI.

  • Do flatpaks have read/write permission to my home folder in Ubuntu? – stackinator Mar 26 '18 at 16:12
  • 1
    Reading the link, it looks like a) they have an elegant solution in mind where apps only get access to files which the user has chosen in a file open/save window etc, b) the default was to grant full access to your home directory. – sourcejedi Mar 26 '18 at 16:17
  • 2
    Web apps are a much more standard solution to this problem, albeit annoyingly inefficient in many cases. Any popular web browser is a highly versatile and thoroughly tested sandbox. – sudo Mar 28 '18 at 8:04
6

It is technically possible and the solutions include apparmor, selinux and firejail or even full containers like LXC or a full virtual machine (e.g. VirtualBox, kvm or vmware). For networking there is opensnitch which is a clone of the littlesnitch program from OSX.

The reasons why there is no widespread security model with permissions given by the user is that traditionally you are careful what you run on your pc. 90% of what's in the appstores of mobile systems would be considered malware on PCs.

There are scanners for adware (i.e. adaware or Spybot D&D) which would classify behaviour like connecting facebook, google analytics and advertising networks as malware on the PC. The mobile ecosystem is like a whole reboot of computing when it comes to these things. Everyone bundles adware, just because it is easy and adds analytics, just because he's curious. The side effects are decreased privacy and security. The security part is accounted for by the sandbox model, the privacy part is still an open problem.

Another reason for not having this on the PC for long is the complexity of a sandbox, which means that it both may be too slow for older PCs some time ago and required more engineering for something which had little advantage then.

Today we see attempts to use sandboxing in new package formats like snap and flatpak and browsers use it for their extensions as well. Chromium uses a permission model since the start and Firefox uses one for all webextensions (since 57 the only extensions you can install). This is quite reasonable, because people install browser extensions from unknown authors just like apps from people they never heard of, thinking they are not more dangerous than a website they visit, which is a fatal misconception when there is no sandbox to protect them.

4

Android uses a "marketplace" security model: different applications come from different (semi-trusted) vendors, and should be isolated from protected resources and each other. Most apps are distributed on for-profit basis: they are sold (payware), show paid advertising, or "monetize" their users by selling their data to third parties. There is a high motivation to engage in illicit data access, even if they get caught.

Most applications in Debian, Red Hat and similar "classic" Linux distributions are distributed in source form: after an open source applications gains enough traction, it is manually chosen for inclusion by distribution maintainers. There is little motivation to perform illicit data access, — potential gains do not justify efforts.

It is worth noting, that advanced security model of Android is one of reasons, why it gained so much traction, easily overcoming iOS on mobile markets. Modern desktop Linux distros aren't just "different", — they are actually well behind times in terms of their security and distribution models.

Some of Linux distributions are coming up with improvements to their software distribution system: centralized third party software repositories (AUR), specialized package formats for distributing third-party software (AppImage, Snappy, Flatpack), secondary repository systems (Docker). Unfortunately, those improvements gain very little traction with time: AppImage has been invented in 2004, first version of AUR was released in 2005, yet none of modern Linux distributions officially adopted their features after >10 years.

3

When I install a program like GIMP or LibreOffice on Linux I'm never asked about permissions.

These applications are installed in a privileged part of the file system which you and most users don't normally have access to change.

On mainstream distros set up for desktop use the single user initially set up when installing will typically have admin rights. All that they'll normally be asked for is their own login password to install software, and not always that.

Once installed the software will, by default, be setup to be executable by normal users and allow data files to be read. That's all that's needed.

By installing a program on Ubuntu, am I explicitly giving that program full permission to read/write anywhere on my drive and full access to the internet?

Not the program. What happens is that the user account belongs to different groups and the different groups grant access to different resources.

The security model on Linux is that your user account has certain rights, and the groups your account belongs to have specific rights. To right to any part of the file system requires root privileges, which are normally not granted to users. Even when you use sudo you do not get all rights.

Normal user accounts typically have access to the resources they'd be expected to need, like the internet.

Theoretically, could GIMP read or delete any directory on my drive, not requiring a sudo-type password?

Any directory or file you, as user, have rights to access can be accessed by the application you launch as it typically inherits your rights. A normally logged in user will not by default normally have the right to alter most of the critical system files or shared files.

I'm only curious if it's technically possible, not if it's likely or not. Of course, I know it's not likely.

Keep in mind that most users typically install applications from repositories that are well policed and the risk of hostile code is low.

I'd probably suggest some additional reading to get to grips with Linux permissions.

The Android security model is evolving to match the needs of users who not only don't generally understand anything about the underlying security model of the OS but hardly understand anything about computers.

The Linux model (which I frankly like more) is designed to allow users (and administrators in particular) to exercise more control over security on the system (within the limits if their allowed permissions).

I think from a user standpoint it's best described as the difference between full-auto and semi-auto or manual control. Modern consumers want full auto. Linux has semi-auto and manual. Most Linux users never need to know about the security model these days, but the control is there if you need or want it.

2

When you install some programs, you are are able to install them within your own userspace (i. e. self-contained within your home directory) and not system-wide. As such, you are not being asked for superuser privileges because you don't need them to install a program for one user's own use. A program thusly installed would indeed not be able to access files not granted the "non-owner non-group members can read this" permission absent a privilege escalation.

  • If the program is installed in my home directory can it read and write anywhere within the home directory? – stackinator Mar 26 '18 at 15:47
  • 2
    It runs with your permissions, so it can access anything you can access. – DopeGhoti Mar 26 '18 at 16:05
  • 1
    On a single user machine, user-only access isn't much safer than root access. Either way, everything important is probably accessible by your user. – sudo Mar 28 '18 at 8:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.