Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.
Sign up to join this community
When I install a program like GIMP or LibreOffice on Linux I'm never asked about permissions. By installing a program on Ubuntu, am I explicitly giving that program full permission to read/write anywhere on my drive and full access to the internet?
Theoretically, could GIMP read or delete any directory on my drive, not requiring a sudo-type password?
I'm only curious if it's technically possible, not if it's likely or not. Of course, I know it's not likely.
There are two things here:
when you install a program by standard means (system installer such as apt/apt-get on Ubuntu) it is usually installed in some directory where it is available to all users (/usr/bin...). This directory requires privileges to be written to so you need special privileges during installation.
when you use the program, it runs with your user id and can only read or write where programs executed with your id are allowed to read or write. In the case of Gimp, you will discover for instance that you cannot edit standard resources such as brushes because they are in the shared /usr/share/gimp/ and that you have to copy them first. This also shows in Edit>Preferences>Folders where most folders come in pairs, a system one which is read-only and a user one that can be written to.
rm -rf ~/. If you install from other sources you have to be careful (or install from source, after a code inspection).
By installing a program on Ubuntu am I explicitly giving that program full permission to read/write anywhere on my drive and full access to the internet?
Yes, if you use sudo or the equivalent, you are giving the installer full permission to read/write anywhere on your drive. This is mostly the same thing. There is also a flag that the installer can set, called setuid, which will make the program have full permissions after install too.
Even if we ignore the installer and if the program is not setuid (it's very rare for programs to use setuid), when you run the program it has full access to anything your account can access. For example, if you're logged into your online banking, it could hypothetically send all your funds to Nigeria.
Why no permissions like Android or iOS?
The security model - that means the way the security system is designed - in Linux is very old. It's inherited from Unix, which dates back to the 1960s. Back then, there was no Internet, and most people in a department used the same computer. Most of your programs came from big companies that were trusted. So the security system was designed to protect users from each other, not to protect users from the programs they run.
Nowadays it is fairly outdated. Android is based on Linux, but it works by creating a separate "user account" for every app, instead of for every user. I don't know what iOS uses. Efforts like Flatpak are currently trying to bring the same sort of thing to the Linux desktop.
What you want is being provided by Flatpack apps. These are very much the equivalent of iOS, Android, or Windows Store apps.
I haven't used them so I don't know if they've implemented the GUI yet, to see the permissions required by each app when it is installed.
Every flatpak application contains a manifest, called metadata. This file describes the details of the application, like its identity (app-id) and what runtime it uses. It also lists the permissions that the application requires.
By default, once installed, an application gets all the permissions that it requested. However, you can override the permissions each time you call flatpak run or globally on a per-application basis by using flatpak override (see manpages for flatpak-run and flatpak-override for details). The handling of application permissions are currently somewhat hidden in the interface, but the long term plan is to show permissions during installation and make it easier to override them.
I also haven't used Ubuntu's alternative, Snappy, to know if it provides such a feature visible in the GUI.
It is technically possible and the solutions include apparmor, selinux and firejail or even full containers like LXC or a full virtual machine (e.g. VirtualBox, kvm or vmware). For networking there is opensnitch which is a clone of the littlesnitch program from OSX.
The reasons why there is no widespread security model with permissions given by the user is that traditionally you are careful what you run on your pc. 90% of what's in the appstores of mobile systems would be considered malware on PCs.
There are scanners for adware (i.e. adaware or Spybot D&D) which would classify behaviour like connecting facebook, google analytics and advertising networks as malware on the PC. The mobile ecosystem is like a whole reboot of computing when it comes to these things. Everyone bundles adware, just because it is easy and adds analytics, just because he's curious. The side effects are decreased privacy and security. The security part is accounted for by the sandbox model, the privacy part is still an open problem.
Another reason for not having this on the PC for long is the complexity of a sandbox, which means that it both may be too slow for older PCs some time ago and required more engineering for something which had little advantage then.
Today we see attempts to use sandboxing in new package formats like snap and flatpak and browsers use it for their extensions as well. Chromium uses a permission model since the start and Firefox uses one for all webextensions (since 57 the only extensions you can install). This is quite reasonable, because people install browser extensions from unknown authors just like apps from people they never heard of, thinking they are not more dangerous than a website they visit, which is a fatal misconception when there is no sandbox to protect them.
Android uses a "marketplace" security model: different applications come from different (semi-trusted) vendors, and should be isolated from protected resources and each other. Most apps are distributed on for-profit basis: they are sold (payware), show paid advertising, or "monetize" their users by selling their data to third parties. There is a high motivation to engage in illicit data access, even if they get caught.
Most applications in Debian, Red Hat and similar "classic" Linux distributions are distributed in source form: after an open source applications gains enough traction, it is manually chosen for inclusion by distribution maintainers. There is little motivation to perform illicit data access, — potential gains do not justify efforts.
It is worth noting, that advanced security model of Android is one of reasons, why it gained so much traction, easily overcoming iOS on mobile markets. Modern desktop Linux distros aren't just "different", — they are actually well behind times in terms of their security and distribution models.
Some of Linux distributions are coming up with improvements to their software distribution system: centralized third party software repositories (AUR), specialized package formats for distributing third-party software (AppImage, Snappy, Flatpack), secondary repository systems (Docker). Unfortunately, those improvements gain very little traction with time: AppImage has been invented in 2004, first version of AUR was released in 2005, yet none of modern Linux distributions officially adopted their features after >10 years.
When I install a program like GIMP or LibreOffice on Linux I'm never asked about permissions.
These applications are installed in a privileged part of the file system which you and most users don't normally have access to change.
On mainstream distros set up for desktop use the single user initially set up when installing will typically have admin rights. All that they'll normally be asked for is their own login password to install software, and not always that.
Once installed the software will, by default, be setup to be executable by normal users and allow data files to be read. That's all that's needed.
By installing a program on Ubuntu, am I explicitly giving that program full permission to read/write anywhere on my drive and full access to the internet?
Not the program. What happens is that the user account belongs to different groups and the different groups grant access to different resources.
The security model on Linux is that your user account has certain rights, and the groups your account belongs to have specific rights. To right to any part of the file system requires root privileges, which are normally not granted to users. Even when you use sudo you do not get all rights.
Normal user accounts typically have access to the resources they'd be expected to need, like the internet.
Theoretically, could GIMP read or delete any directory on my drive, not requiring a sudo-type password?
Any directory or file you, as user, have rights to access can be accessed by the application you launch as it typically inherits your rights. A normally logged in user will not by default normally have the right to alter most of the critical system files or shared files.
I'm only curious if it's technically possible, not if it's likely or not. Of course, I know it's not likely.
Keep in mind that most users typically install applications from repositories that are well policed and the risk of hostile code is low.
I'd probably suggest some additional reading to get to grips with Linux permissions.
The Android security model is evolving to match the needs of users who not only don't generally understand anything about the underlying security model of the OS but hardly understand anything about computers.
The Linux model (which I frankly like more) is designed to allow users (and administrators in particular) to exercise more control over security on the system (within the limits if their allowed permissions).
I think from a user standpoint it's best described as the difference between full-auto and semi-auto or manual control. Modern consumers want full auto. Linux has semi-auto and manual. Most Linux users never need to know about the security model these days, but the control is there if you need or want it.
When you install some programs, you are are able to install them within your own userspace (i. e. self-contained within your home directory) and not system-wide. As such, you are not being asked for superuser privileges because you don't need them to install a program for one user's own use. A program thusly installed would indeed not be able to access files not granted the "non-owner non-group members can read this" permission absent a privilege escalation.
