protonscr

User level installer overwrites root owned files

steamclosed reviewed
ValveSoftware/steam-for-linux#4314 · opened 2016-02-12 by Mantriur · updated 2016-02-12 · 8 comments · github
MMantriur 2016-02-12 github

While trying to replace the tray icon at ~/.local/share/Steam/public/steam_tray_mono.png (it defaults to white on light themes and black on dark themes), I noticed that the installer will happily overwrite root owned files while running in user mode. Please respect file permissions, using elevation to overrule root on behalf of the user can be dangerous.

To reproduce, just replace aforementioned file, set group/owner to root, run steam, see the file get replaced and user owned. I assume it's a general installer behavior, but didn't verify that.

root@vader:/home/tauge/.local/share/Steam/public# chown root:root steam_tray_mono.png 
root@vader:/home/tauge/.local/share/Steam/public# ls -l steam_tray_mono.png 
-rwxr-xr-x 1 root root 5093 Feb 12 15:44 steam_tray_mono.png

# Steam ran here, automatically reran installation

root@vader:/home/tauge/.local/share/Steam/public# ls -l steam_tray_mono.png 
-rwxr-xr-x 1 tauge tauge 5405 Nov 11  2014 steam_tray_mono.png

TTele42 2016-02-12 github

@Mantriur you may be able to be more forceful by making the file immutable with chattr +i. As a rule, steam itself is never allowed to elevate privileges to root, it must always hand what it wants done to a distro provided helper. Just a random guess, but I think steam is deleting the entire folder and replacing it.

PPlagman 2016-02-12 github

If Steam detects a corrupt file, it'll re-bootstrap itself for your user in order to repair it, but it should never do so as root. In fact, the /usr/bin/steam helper will refuse to run as root, and there should be no suid helper or anything like that. I don't believe there's a problem here.

TTele42 2016-02-12 github

@Plagman the problem is that @Mantriur can't find how to select a dark tray icon that goes well with light desktop themes.

PPlagman 2016-02-12 github

The desktop environment should tint the monochrome icon to match the foreground color of the desired theme, so I think Steam is providing the right resources for this to work properly. Did you report this to your desktop environment maintainers?

MMantriur 2016-02-12 github

No, I gave up on the icon, I'm not good with desktops. :/ But it's good to know that it's not the wrong icon, but the taint not working, thanks!

The issue at hand:

root@vader:/home/tauge# cd .local/share/Steam/
root@vader:/home/tauge/.local/share/Steam# rm ./public/steam_tray_mono.png
root@vader:/home/tauge/.local/share/Steam# touch ./public/steam_tray_mono.png
root@vader:/home/tauge/.local/share/Steam# ls -l ./public/steam_tray_mono.png 
-rw-r--r-- 1 root root 0 Feb 12 17:06 ./public/steam_tray_mono.png
root@vader:/home/tauge/.local/share/Steam# su - tauge
tauge@vader:~$ which steam
/usr/bin/steam
tauge@vader:~$ ls -l /usr/bin/steam
-rwxr-xr-x 1 root root 5390 Nov 17 17:07 /usr/bin/steam
tauge@vader:~$ steam
Running Steam on linuxmint 1 64-bit
STEAM_RUNTIME is enabled automatically
# ... whole lot of steam output removed
tauge@vader:~$ ls -l .local/share/Steam/public/steam_tray_mono.png 
-rwxr-xr-x 1 tauge tauge 5405 Nov 11  2014 .local/share/Steam/public/steam_tray_mono.png

QED ;-)

PPlagman 2016-02-12 github

As I said, there's no issue here. If you create a file as root that's within a directory owned by another user, it's totally expected that this file can go away. There's no elevation whatsoever coming from Steam itself, everything it does post initial packages install (which goes through 'sudo') is run as your own user ID.

MMantriur 2016-02-12 github

Oh. You are right, directory owner can delete directories even without permissions to the individual files. That was news to me. Sorry!

PPlagman 2016-02-12 github

No worries; note that if you create your own icon, but pad the file size so that it's identical to our original icon, Steam will not try to replace it until we update it, which isn't going to happen for a while.

Nothing extracted yet.