protonscr

Security issue: Proton maps all mount points to drive letters for most games

protonclosed
ValveSoftware/Proton#5522 · opened 2022-01-28 by fluffynuts · updated 2022-01-28 · 2 comments · github
Ffluffynuts 2022-01-28 github

A discussion on the ProtonDB discord around the potential for windows viruses to run via Proton led to a little digging, and it's not great that Proton is mapping in all of the mount points on my system, especially root - though oddly enough, not /home:

image

This means that games have access to any file which is read-write on the system, even though they shouldn't need to. I'm probably going to write a clean-up tool to resolve these links on my system, but this should, imo, be fixed.

Ffluffynuts 2022-01-28 github

There are some games where dosdevices doesn't exist for me (eg 1057090 - Ori and the Will of the Wisps). I'm assuming this might have something to do with the Proton version that was present during installation? On my machine, Ori is running with the default version for the game, so I'm not sure what that is.

Kkisak-valve maintainer 2022-01-28 github

Hello @fluffynuts, please see the discussion on #3979. Closing as a duplicate.

Nothing extracted yet.