Post B7OWGWlcPVIxBDGCPI by mia@movsw.0x0.st
 (DIR) More posts by mia@movsw.0x0.st
 (DIR) Post #B7OWGWlcPVIxBDGCPI by mia@movsw.0x0.st
       1 likes, 0 repeats
       
       some software uses sockets instead but still has no access controls. on unix-like systems, the sockets are often placed in /tmp, which additionally exposes the attack surface to other users on systems without private /tmpfor example, if an mpv frontend has a single-instance feature and accepts commands (for example, to append to the playlist), it may inadvertently expose the run and subprocess commands as well. this is the case with e.g. smplayera more common variant is proprietary windows driver software that uses a local http server to allow remote control via unprivileged processes or webshit. many of those had local and remote command execution vulnerabilities (with SYSTEM privs no less) because they failed to authenticate requests, and others installed TLS certificates into the system trust store that eventually had their private keys leaked.the moral of the story is that in current year none of the major desktop operating systems provide good authenticated IPC (or RPC), which results in crude hacks like thisRE: https://movsw.0x0.st/notes/ankb1owjepyldt85
       
 (DIR) Post #B7OZRzM4lERutMTAqe by littlefox@gotosocial-dev.svc.0x0a.network
       0 likes, 0 repeats
       
       @mia isn't access control on unix sockets meant to be done via fs permissions?
       
 (DIR) Post #B7OZRzXQ53WVSXmEWu by mia@movsw.0x0.st
       0 likes, 0 repeats
       
       @littlefox not really: the system user being the lowest level of granularity prevents protecting the socket from unintended access by less trusted processes.this can be done with selinux and apparmor, but that1) won’t happen unless distros install rules2) is extremely unwieldy in the case of selinux3) may cause legitimate access to fail with absolutely no indication to the user that it was blocked by a specific security policyit might make more sense to think about this problem the same way you think about suid executables. the flaws in the local security model inherited from unix are the elephant in the room here
       
 (DIR) Post #B7Oa6yUmrSEe6D5Vho by mia@movsw.0x0.st
       0 likes, 0 repeats
       
       @littlefox on systemd systems it’s also sometimes done by running processes as scoped units with namespace isolation (which is a hack and basically the equivalent of creating transient userdb entries for every process)
       
 (DIR) Post #B7RU3GIghkePuX9eUK by lain@ferretfrizz.biz
       0 likes, 0 repeats
       
       @miaWhat do you think about dbus? Or is that not relevant because it's not provided by the operating system
       
 (DIR) Post #B7RU3GW9tfQUaJSPU8 by mia@movsw.0x0.st
       0 likes, 0 repeats
       
       @lain d-bus is a symptom
       
 (DIR) Post #B7RUYXhu2LwMsErfUW by mia@movsw.0x0.st
       0 likes, 0 repeats
       
       @lain we’ll see how the latest attempt at bus1 goes, i guess