[arch-general] Standard group for "hardware user"?

[Tobias Hunger]

Hi Neale,

The packages in arch are built with the systemd security model in
mind. You are changing that pretty fundamental assumption by ripping
out systemd, logind & co. and that will have an effect on the overall
security of your system. At least give the packages a chance to
respond to that changed assumption by rebuilding them, telling them
that there won't be any systemd. That way they can adapt their
configuration and permissions during install (not that I think many
will;-). Ideally you would also go through all PKGBUILDs with a fine
toothed comb to find settings that need to be adapted from the
arch-defaults before rebuilding.

Of course you also need to be aware of the security issues that were
fixed by logind. This is mostly (remote) users being able to snoop on
local users by recording keystrokes or even audio/video of them at the
machine. People argue that this is not much of an issue on a
single-user machine.

You also will need to run xorg as root, which is a huge piece of code
known to be written before security was a concern to developers.
Logind allows to run that as a normal user (provided other conditions
are met as well).

TL;DR: Replacing systemd in arch is nothing that should be attempted
in an idle afternoon.

Best Regards,
Tobias

On Tue, Jan 6, 2015 at 12:42 AM, Neale Pickett <neale at woozle.org> wrote:
> I'm not going to remove any groups, but I want to make sure I'm not
> configuring mdev to set ownership to a group that may not exist in the
> future. I will probably create a new group called "hardware" that will
> allow users to access audio, video, serial, and USB storage devices, and
> use Posix ACLs to set individual permissions for daemons like mpd. Things
> that are packaged now should continue to work (or not) as normal with
> Arch's default filesystem groups if they're using my mdev/runit setup.
>
> I do have systemd installed. Too many things depend on it for me to remove
> it. If I could remove or recompile X11, tcpdump (libusb), nfs-utils
> (device-mapper), and procps-ng, I think I might be able to remove the
> systemd package. But I have enough work already, I don't need to go
> recompiling stuff just to get rid a single dependency! :)
>
> On Mon Jan 05 2015 at 3:47:37 PM Leonid Isaev <lisaev at umail.iu.edu> wrote:
>
>> On Mon, Jan 05, 2015 at 09:59:51PM +0000, Neale Pickett wrote:
>> > This is very helpful. Thank you!
>>
>> If you go with your own group list, check configs of your daemons to see
>> which
>> groups they expect. Some (e.g. dnsmasq) will call useradd and groupadd in
>> their
>> .install files. But syslog-ng, for example, by default creates log files
>> 640
>> root:log...
>>
>> Also, I just wonder, do you have systemd installed at all?
>>
>> Cheers,
>> --
>> Leonid Isaev
>> GPG fingerprints: DA92 034D B4A8 EC51 7EA6  20DF 9291 EE8A 043C B8C4
>>                   C0DF 20D0 C075 C3F1 E1BE  775A A7AE F6CB 164B 5A6D
>>