consider hardening binary plugin search #32

New issue

Open

opened 2025-08-11 13:20:38 +03:00 by arseny · 2 comments

arseny commented

2025-08-11 13:20:38 +03:00

So plugins as of a751505d5a can currently reside in:

$libdir/tuner/plugins
$datadir/tuner
~/.local/share/tuner/plugins
whatever is present in $TUNER_PLUGIN_SEARCH_PATH.

In a classic GNU/Linux environment, the first two of these locations are only writable by root (i. e. package manager or pre-baked bootable image), and might be mounted read-only, covered by fsverity, ima-evm, etc.
In the same environment the $HOME hierarchy is freely user-writable, which is convenient for development purposes, but opens up attack surface (e. g. a malicious .so, see also #30, can shadow a system-provided plugin). E. g. Chromium can also write anywhere in $HOME.

My suggestion is:
— to add a way to restrict plugin search to system locations,
— and make that the default, so to allow extending the search path the builder has to enable a meson build option.

So plugins as of a751505d5af69a41ebdd5ecdf3eb6a9f02e58da5 can currently reside in: * `$libdir/tuner/plugins` * `$datadir/tuner` * `~/.local/share/tuner/plugins` * whatever is present in `$TUNER_PLUGIN_SEARCH_PATH`. In a classic GNU/Linux environment, the first two of these locations are only writable by root (i. e. package manager or pre-baked bootable image), and might be mounted read-only, covered by fsverity, ima-evm, etc. In the same environment the `$HOME` hierarchy is freely user-writable, which is convenient for development purposes, but opens up attack surface (e. g. a malicious `.so`, see also #30, can shadow a system-provided plugin). E. g. Chromium can also write anywhere in `$HOME`. My suggestion is: — to add a way to restrict plugin search to system locations, — and make that the default, so to allow extending the search path the builder has to enable a meson build option.

arseny commented

2025-08-11 13:20:48 +03:00

Author

...Part of the reason $XDG_DATA_HOME is defined by default to be $HOME/.local/share is so $XDG_DATA_HOME is not specific to the machine architecture. It's a datadir, after all. :)

...Part of the reason `$XDG_DATA_HOME` is defined by default to be `$HOME/.local/share` is so `$XDG_DATA_HOME` is not specific to the machine architecture. It's a datadir, after all. :)

arseny commented

2025-08-11 13:25:01 +03:00

Author

@arseny wrote in #32 (comment):

— and make that the default, so to allow extending the search path the builder has to enable a meson build option.

The inverse made total sense during the planning and early development phases. Now the project seems to gain a user base, thus this suggestion.
The degree to what we should harden Tuner, both optionally and in general, is up for discussion and careful consideration, of course.

@arseny wrote in https://altlinux.space/alt-gnome/Tuner/issues/32#issue-2628: > — and make that the default, so to allow extending the search path the builder has to enable a meson build option. The inverse made total sense during the planning and early development phases. Now the project seems to gain a user base, thus this suggestion. The degree to what we should harden Tuner, both optionally and in general, is up for discussion and careful consideration, of course.