[personal profile] mjg59
Ubuntu 16.04 was released today, with one of the highlights being the new Snap package format. Snaps are intended to make it easier to distribute applications for Ubuntu - they include their dependencies rather than relying on the archive, they can be updated on a schedule that's separate from the distribution itself and they're confined by a strong security policy that makes it impossible for an app to steal your data.

At least, that's what Canonical assert. It's true in a sense - if you're using Snap packages on Mir (ie, Ubuntu mobile) then there's a genuine improvement in security. But if you're using X11 (ie, Ubuntu desktop) it's horribly, awfully misleading. Any Snap package you install is completely capable of copying all your private data to wherever it wants with very little difficulty.

The problem here is the X11 windowing system. X has no real concept of different levels of application trust. Any application can register to receive keystrokes from any other application. Any application can inject fake key events into the input stream. An application that is otherwise confined by strong security policies can simply type into another window. An application that has no access to any of your private data can wait until your session is idle, open an unconfined terminal and then use curl to send your data to a remote site. As long as Ubuntu desktop still uses X11, the Snap format provides you with very little meaningful security. Mir and Wayland both fix this, which is why Wayland is a prerequisite for the sandboxed xdg-app design.

I've produced a quick proof of concept of this. Grab XEvilTeddy from git, install Snapcraft (it's in 16.04), snapcraft snap, sudo snap install xevilteddy*.snap, /snap/bin/xevilteddy.xteddy . An adorable teddy bear! How cute. Now open Firefox and start typing, then check back in your terminal window. Oh no! All my secrets. Open another terminal window and give it focus. Oh no! An injected command that could instead have been a curl session that uploaded your private SSH keys to somewhere that's not going to respect your privacy.

The Snap format provides a lot of underlying technology that is a great step towards being able to protect systems against untrustworthy third-party applications, and once Ubuntu shifts to using Mir by default it'll be much better than the status quo. But right now the protections it provides are easily circumvented, and it's disingenuous to claim that it currently gives desktop users any real security.

The Horror!

Date: 2016-04-22 11:18 am (UTC)
From: (Anonymous)
Oh no! An application running in a snap can do the *exact same thing* any other application running on the system can do! The world is ending! The world is ending!

Y'know, unless snapd runs the equivalent of `xauth generate $DISPLAY . untrusted` before it runs the application itself.

Re: The Horror!

Date: 2016-04-22 01:52 pm (UTC)
From: (Anonymous)
Yes, but the point is that Canonical was touting Snaps as being more secur

"The security mechanisms in snap packages allow us to open up the platform for much faster iteration across all of our flavours as snap applications are isolated from the rest of the system. Users can install a snap without having to worry whether it will have an impact on their other apps or their system."

Re: The Horror!

Date: 2016-04-24 05:24 am (UTC)
From: (Anonymous)
putting a sticky tape on the keyhole to my car is more secure than no sticky tape.

Canonical never claimed the benchmark of or the highest level of security.

It doesn't matter if i win by 1 point or 100 points winning is still winning.
like wise even 1% more secure is still technically more secure.

Re: The Horror!

Date: 2016-04-24 03:12 pm (UTC)
From: (Anonymous)
"snap applications are isolated from the rest of the system. Users can install a snap without having to worry whether it will have an impact on their other apps or their system."

Does that marketing speak sound like Canonical is limiting their claim in any way?

Sure doesn't to me.

Re: The Horror!

Date: 2016-04-22 02:57 pm (UTC)
From: (Anonymous)
There is a huge difference. I use only two types of software: Packages that are in the Debian "main" archive or software I wrote myself. Forget about the latter.

The former can have backdoors, of course, but at least there is some kind of control. Because the packages are built from source code, backdoors can be identified, hopefully. The security level will be even better when reproducible builds are in place.

Snap and xdg-app seem to a way to distribute untrusted, maybe even proprietary, programs to otherwise free systems. No idea, why one would want that, but some of their security improvements are very good, e.g. sandboxing, no maintainer scripts...

Re: The Horror!

Date: 2016-04-23 12:44 am (UTC)
From: (Anonymous)
What's wrong adding independent proprietary app to free software?
There's nothing wrong with it. Its called democracy.

Re: The Horror!

Date: 2016-04-23 07:09 am (UTC)
From: (Anonymous)
Hello Democracy, this is Patrick.

Re: The Horror!

Date: 2016-04-26 02:23 pm (UTC)
From: (Anonymous)
Hello democracy, this is Bob, I'm with Patrick.


Matthew Garrett

About Matthew

Power management, mobile and firmware developer on Linux. Security developer at Google. Member of the Free Software Foundation board of directors. Ex-biologist. @mjg59 on Twitter. Content here should not be interpreted as the opinion of my employer.

Page Summary

Expand Cut Tags

No cut tags