Tell me more ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.
up vote 6 down vote favorite
2

I need to run a program (libreoffice) as another user. I noticed that the program started in the background when invoked as kdesudo -u otheruser libreoffice, possibly to avoid social engineering attacks.

(in the below text, "logged-in user" refers to me, not "otheruser")

  • Is it safe to run an untrusted program in this way?
  • Does it affect the current logged-in user? (file and process access in the context of the logged-in user)

Denial of Service attacks by fork-bombs, using excess CPU, etc. are excluded since those can occur too if I login directly on otheruser. For clarity, I'm looking for differences between running programs in directly when logged in as otheruser and running programs using kdesudo, gksudo and sudo.

share|improve this question

1 Answer

up vote 3 down vote accepted

For security purposes, assume that programs that have access to your X display can do whatever they want, including snooping on your clipboard, sending fake keystrokes to another application and other non-niceties. X just wasn't designed with isolation in mind.

For the curious or paranoid, read Secure Linux Desktop and Passive and active attacks via X11. Is Wayland any better?. For the extremely paranoid, check out Qubes, which is based on virtualized Linux instances, each running its own X server.

If you're concerned about running untrusted X applications, you must run them on a separate X display, in addition to running them as a different user (or better, in a different (virtual) machine). You can run a separate X server and display it in a nested X window in various ways: through a virtual machine (VirtualBox, VMware, …), with a remote X server such as VNC which you just happen to connect to locally, or with a special-purpose X-in-X program such as Xnest or Xephyr.

If you're concerned about social engineering attacks, that's a different problem. Social engineering targets the user; the only way to avoid them is to leave the user out.

share|improve this answer
Those security.SE questions are interesting. A virtual / other machine defeats the use of the same system: using already installed applications and settings. Social engineering is not my concern since I'm very conscious about security. From your answer, I deduce that any application ran using kdesudo or gksu is unsafe because X is shared, but doesn't that imply that using kdesudo for running as the other user is quite useless? – Lekensteyn Jun 1 '11 at 21:16
1  
@Lekensteyn: Running as another user protects against attacks that don't use X as a vector. Depending on how paranoid you are, that's either useless or better than nothing. – Gilles Jun 1 '11 at 21:18
is it possible that my passphrase input gets captured when entering it in a kdesudo dialog? Or that my Firefox session gets captured? Just for clarifications, because your answer suggest so. – Lekensteyn Jun 1 '11 at 21:22
@Lekensteyn: Yes, it's possible if you allow a rogue application to run on the same X server. Joanna Rutkowska's blog article explains one way. – Gilles Jun 1 '11 at 21:36

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.