Hacker News Reader

Comment by aeleos | Hacker News Reader

That is pretty scary. Anyone know if there is any info on if it will only encrypt the c_drive folder that wine makes or the entire fs?

View on HN

Isn't the entier fs exposed as Z: or so in wine? I know there's some way to get to the user's home directory which is probably good enough to cause essentially the same amount of pain.

yea it seems Z: is mapped to the root fs, so if wine has the right permissions it could cause some damage.

Most interesting. However, you have to butcher your system a bit in order to make that happen... That doesn't say there aren't setups like that, but they are really one out of million.

How is that so? I believe Wine processes have r/w access to the user's home directory.

And most of your valuable stuff will be in your user dir if you're on a personal computer.

> entier fs exposed as Z: or so in wine

By default only. You can easily disable that. It always made me worried that anything in wine got access to my system, even though I normally wanted something closer to an isolated instance, so I always disabled that.

There may also be links to your home directory as "Desktop", "My Documents", etc. See winecfg for these. And note that your registry files may refer to Z: (mostly for fonts, it seems), or even directly to files outside your Wine directory.

If the software is Wine-aware, it doesn't matter. The \\unix\ filesystem namespace allows programs running under Wine to access the host filesystem whether it's mapped as a drive or not. And, of course, since Wine Is Not an Emulator, it could also use POSIX APIs or Linux kernel syscalls directly if it wanted to.

Have there been reports of Wine-aware malware already? (If not, the next generation probably will, though.)

Wine is not an isolation layer. You can disable the Z: drive but the applications running in Wine still have about the same access a normal application has.

On that note, is is possible to sandbox wine so that it can only access the c_drive folder, not the whole host fs?

Yep. Try apparmor or similar.

Reply on news.ycombinator.com