KDE6 release: D-Bus and Polkit Galore | Hacker News Reader

KDE6 release: D-Bus and Polkit Galore

security.opensuse.org

180 pointsmilliams70 comments

the actual end user security could get the same love.

the privilege escalation dialog is mostly a windows 10 copy, but just shows: allow dbus.something.something"? the name is always meaningless and have no parameters. and there's zero way to get more information. windows at least shows the binary or PowerShell command plus the arguments.

I agree, it always feels strange putting my root password into a box that just popped up. True, it's only ever been in direct connection with a command line program I'm running, but there's nothing hard linking the terminal with the GUI window.

I think that either the terminal program should print something like a PIN which is repeated in the window to cross-check, or the window should be able to use some restricted window manager feature (like Windows' fullscreen greying out thing) to prove that it's not just a random Qt/GTK window from an attacker's script.

The problem is that in a sense it is just some random Qt/Gtk window. I have recently written my own PolKit agent. It runs purely in userspace without any special privileges. An attacker could kill your legitimate PolKit agent, register itself as your agent, even act as one, and also steal your password the next time you do actually authenticate something. In that sense a PIN linking the command line to the agent window doesn't save you.

I agree this situation needs improving, the problem just runs much, much deeper.

On the other hand: if an attacker placed a modified sudo that steals your password in ~/.local/bin, it would also be Game Over. Much of the current security model breaks as soon as the attacker has code execution.

EDIT: I'd also like to highlight this:

> or the window should be able to use some restricted window manager feature (like Windows' fullscreen greying out thing) to prove

Your Wayland compositor also runs in userspace. Even if it is supposed to check that some calls come from euid 0, an attacker may be able to circumvent them if the attacker runs in the same context as the compositor. Again, the security problem runs very deep.

As much as I love linux, it is very painful to accept the state of “security”, this is beyond criminal. Especially that many people just put their head into the sand.

The age-old xkcd about linux being secure only about your video card driver is still true to this age, with no clear sign of improvement.

Also, frankly I don’t understand why there is no more cross-pollination between android and linux userspace - the former has actually solved this issue properly.

I’m afraid the answer is that “it is not written in c”.

> I’m afraid the answer is that “it is not written in c”.

I don't think it has anything to do with it. Android's security comes from design, not language. Each application runs under its own UID and not all applications can draw arbitrary content on your screen, for example.

Those things could be on the Linux Desktop. And maybe flatpak will bring it to us. But for now I can already hear the screeching about "freedom" and "the Unix philosophy".

> Android's security comes from design

"This application requires storage permission. Grant ?"

Yes. Comes from design. /s

Still better than Flatpak's "install time permissions".

> the window should be able to use some restricted window manager feature (like Windows' fullscreen greying out thing)

No FOSS desktop is even close to offering this. The windows 'greying out thing' is an entirely separate desktop instance, for example. A lot of security consideration was put into designing it. I don't think any FOSS desktop is working on anything even remotely similar, which is a shame.

What prevents any random Windows application to make a screenshot and apply "greying out" filter to it? I mean, I launch a game and it puts full-screen image of whatever it wants. It doesn't take any special permissions to make a screenshot either.

The only true security feature I remember was implemented in Windows many years ago. After you got security prompt, you would need to press Ctrl+Alt+Delete and type password there. Supposedly only Windows itself could handle that combination.

Nothing will prevent that. The question is, what would you do with the stolen credentials in terms of privilege escalation? Suppose we are in a situation where the UAC is on and asks for every action on the secure desktop. Even if you were to authenticate with the stolen credentials, you would end up in an unprivileged session due to UAC's token filtering mechanisms. If you were then to request elevation, the UAC would prompt the user on the secure desktop, which you cannot control from within the user session. It is therefore not enough to imitate the prompt. You also need to convince the user to accept the real prompt.

If you write a piece of malware that spoofs the secure desktop prompt, then you can steal the users password or whatever. But that does not grant you higher privileges. Only the secure desktop can grant your process higher privileges. The password only authenticates you. It does not authorize you. So now your malware tries to use the credentials it stole to perform a restricted task afterword, but it will not have the proper privileges (elevated security token), so the user will get forced into the UAC prompt on the Secure Desktop. You cannot stop this from happening once you attempt to do it. The exact scenario you are describing, spoofing the secure desktop prompt, was literally the basics of the UAC prompt thought up over 15 years ago. It's like the 101 example.

In contrast, on Linux, if you put a shell script in the users $PATH called 'sudo' that simply captures their password, you can (assuming the default PAM configuration) immediately use that to elevate privileges anytime you want with absolutely no intervention whatsoever. Because the password not only authenticates you, it authorizes you as well.

> What prevents any random Windows application to make a screenshot and apply "greying out" filter to it? I mean, I launch a game and it puts full-screen image of whatever it wants. It doesn't take any special permissions to make a screenshot either.

Because you would be able to alt+tab to other tasks, and that application would be able to still execute code as it was able to before. It's not any kind of security 'behind the scenes'.

> The only true security feature I remember was implemented in Windows many years ago.

Or perhaps you didn't realize all the engineering that was taking place behind just what you see. This[0] blog post gives a good overview of some of the security architecture that went into making that elevation prompt.

Honestly, MS has been leading the pack in OS security for some time. They are leagues ahead of MacOS and Linux.

[0] https://learn.microsoft.com/en-us/archive/blogs/uac/user-acc...

Why would I do "alt-tab"? Do you think users typically type alt-tab when asked for admin permissions? I never did that.

It's all security theater.

It isn't security theater at all. Did you read the link?

You wouldn't be able to switch to another application is the point. What you suggest greying out, would easily allow other applications to hijack that prompt or replace it with their own.

That's a large part of what 'Secure Desktop' aims to prevent, and it succeeds at doing so.

That's not the point they were trying to make. They were asking what would prevent malware from imitating the UAC prompt to steal administrator privileges.

https://learn.microsoft.com/en-us/windows/security/applicati...

> If the policy setting is set to Prompt for credentials, malware imitating the credential prompt might be able to gather the credentials from the user. However, the malware doesn't gain elevated privilege and the system has other protections that mitigate malware from taking control of the user interface even with a harvested password.

So just knowing the credentials is not enough, they have to be used in the right context (the secure desktop).

I understand and answered that. The answer is Secure Desktop, details on which can be found in the link I posted in my earlier comment.

I don't know much about openSUSE, but it's nice to see the security effort that goes on before importing a large update like KDE6.

It must be nice to get such a review of your code and design, and it looks like KDE appreciated it (probably they expected it, hence the early reach out). Kumbaya but non sarcastic :)

I'm positively surprised someone is looking at all so deeply into potential desktop local privescs, I just assumed the extreme complexity of your average default plasma desktop vs. the relative few users, meant it is probably full of vulnerabilities just not worth the effort of finding them.

Why was this not done with RAII - https://invent.kde.org/frameworks/kauth/-/commit/fc70fb0161c... - if there was an exception between here

    QVariantMap args;
    QDataStream s(&arguments, QIODevice::ReadOnly);
    s >> args;

Then it won't restore the global. Also ... global ugh

These sorts of articles reaffirms to me that there is a dire need to switch to capability based security models. Managing the security with the set of tools we have available in the legacy model leaves lots of room for error.

The update doesn't seem too bad - but I did (initially) make the mistake of calling zypper from within KDE, which leads to a crash and leaves the system in an invalid state.

(ctrl+alt+f4 from the login screen allows you to get to a command line without starting KDE, and that allows for the upgrade to complete.)

I do think that this shouldn't be allowed; zypper should exit gracefully and inform the user how to safely perform the upgrade.

Why could zipper not update the stuff on disk, then prompt you to logout/login to load the new binaries? Windows and MacOS afaik don't require you to change to a tty to update the GUI.

I've got no idea, but allowing partial updates seems to be the worst of all options.

I hesitate to use the word 'bloat', but ever since DKE4 with that Avahi service or whatever it was, that's the impression I've had of KDE. It almost feels like a separate OS on top of an OS.

I guess it's just not for me. About a year ago I discovered AwesomeWM and just how flexible and configurable it is - I can truly have a 100% completely customized desktop down to every detail.

Even without that though I'd probably opt for something like XFCE if I wanted something with a desktop and taskbar. There's just no good reason a desktop has to be as heavy as more popular options. Even the Windows desktop isn't as heavy.

> Even the Windows desktop isn't as heavy.

Have you used Windows recently[0]?

KDE is definitely lighter than Windows, in both mental load and RAM usage. At least as of late Windows 10 and early Windows 11, which were the last times I used it with any regularity.

I'll stick with sway though for now, and I'm excited for the new Cosmic version coming soon.

[0] Recently is relative of course. It's been a while for me.

If you haven't revisited it since those days, Plasma 5 eventually achieved a reputation for being relatively light-weight - a default session was, at some points (maybe still is), lighter than XFce, getting it design wins on lower-powered ARM devices like the Pinebook at the time.

This was the result of projects like Plasma Mobile, and also the community intentionally focusing on hardware vendors and embedded as a growth area (as now seen with deployments like the Steam Deck or Mercedes-Benz cars).

Criticism of KDE 4 as bloated is well-taken, but we've since done quite a lot to repent :-) Disclaimer: I'm a KDE contributor.

> If you haven't revisited it since those days, Plasma 5 eventually achieved a reputation for being relatively light-weight - a default session was, at some points (maybe still is), lighter than XFce

That is very interesting! I will definitely give it another look. Is it still running that service that started with 'a'? What was the reason for that? I always found that so frustrating. I remember fighting with it to try and kill it or disable it way back in the day.

> Criticism of KDE 4 as bloated is well-taken, but we've since done quite a lot to repent :-) Disclaimer: I'm a KDE contributor.

Thank you for all the work you do!

I think you're thinking of "Akonadi", a service used for calendars, contacts, emails, RSS etc. It famously originally came with a MySQL server dependency (though I think that it might now work with SQLite).

I just checked, Akonadi still uses MySQL on Plasma 6. But you can probably disable it (in settings > background services > Account manager (translated from French so possibly not accurate)) if you don't use any PIM feature of KDE (contacts, mails). Now, it's quite idle, so one wouldn't need to worry about it I think.

Baloo, Nepomuk's successor, has also improved a lot and file indexing can be disabled, or folders excluded from indexing.

And I agree about Plasma being lightweight: that's what I run on a 12 year old tablet which has 1GB of RAM because it has been the only touch-friendly DE that was lightweight enough for years. Now, we have Plasma mobile and Phosh that might do the job better.

Requiring MySQL for a desktop service running in the background honestly seems crazy to me.

Apparently one can switch databases and use PostgreSQL or SQLite instead.

Not sure why SQLite is not the default. Maybe they expect several applications to write to the DB concurrently and expect that SQLite might cause perf issues. Though there's nothing in the doc about this.

they used mysql embedded... many softwares on windows uses sql server embedded, for just specific applications

Why? I mean, if there is a single, even slightly heavy db running for a desktop environment that would seem fine. Of course each service having its own is an overkill.

I moved to i3 then to Xmonad after years of Gnome, I felt similar, just too much junk.

Recently I set up a few new laptops and decided to try KDE as a "base layer" for various utilities I need, as its easier to install the DE and get the utilities as deps than download them all myself.

The annoying truth about tiling WMs that I ignored for years is man it takes so much time to get set up exactly how you like it. I could drop in my xmonad setup like I've done on other machines, but I want to try one of the wayland offerings and just the time commitment is making me put it off.

That being said, the most recent KDE plasma desktop is extremely snappy and polished feeling. More so than the windows desktop, and I feel like its 85% as smooth as say MacOS. I've yet to test battery life compared to a bare bones suckless tiling setup, but I'm still getting very good battery life without it.

I have not tried KDE 6 yet, but I have been running KDE 5 on Debian for about 1.5 years and with few exceptions, I find it to be fast, relatively bloat-free, and almost infinitely configurable.

On my systems, it uses something like 1.2 GB of memory out of the box. Meaning you have a _very_ usable machine even with only 4 GB of RAM, as long as you can avoid the temptation to run Electron apps. Pretty sure that is impossible with Windows.

I've tried basically every Linux DE and WM since I first started using Linux in 1996, and basically haven't been happier with the overall experience than I am now. Which scares me a little bit, because every time I get comfortable with a DE, someone decides to throw it all out and rewrite the thing from scratch. (GNOME 2->3, KDE 3->4, etc.)

> Pretty sure that is impossible with Windows.

A fresh Windows 10 install on a system with 4GB of ram will idle at around 1GB used. Perhaps your comment is correct in regards to Windows 11, though.

KDE6 has been pretty good to me, you should try it! Or wait for 6.1.

I don't think they are comparable anyway, plasma is a desktop environment not a window manager. I mean plasma5 has an incredible amount of features, and it's extensible by Qt/QML widgets that are very easy to write. Sure you can say you don't really need its features, like it's bluetooth integration, its audio mixer, multihead display settings, notifications with individually configurable alerts, per-application or window customization, integrated screenshot and screen recording, MTP/NFS/SMB/etc. integration, file content fts, etc. etc.

And I'm sure you could achieve all of it somehow in awesomewm/i3wm/etc. but to me it just feels like a waste of time and a bad user experience. Perhaps I'm just getting old and rather focus on more interesting things than the configuration files of my window manager.

Disclaimer: I've been using Linux on the desktop exclusively since before Windows XP.

> Even the Windows desktop isn't as heavy

LOL. No. Try Window 11 then try KDE 5 or 6. No comparison.

You are comparing KDE4, a 10 year old release which was not well optimized.

KDE has become more efficient while Windows has become more bogged down and bloated with ads and telemetry and crapware. It is unusable before running a debloating script.

I don't know about Windows 11, but Windows 10 is still very snappy on old hardware with low ram. Windows has a lot of issues but desktop responsiveness isn't typically one of them.

Windows 10 is more bloated than Windows 8.

Windows 11 is worse than 10. Even if it was more responsive, the ads are obnoxious.

No ads on my windows 10. Yes you have to configure it a bit after install, but once you do it can be pretty lean. I ran it on a machine with no more than 4gb for a few years and it was fine, clean and fast.

I was talking about Windows 11. That is much worse.

Yeah of course there are ways to get rid of all that. Plenty of decrapifier scripts on Github. I use https://atlasos.net

and probably kde 4.0 or 4.1, not the later releases where things were kinda good

I feel you. I have become a sway and xmonad user on my machines after years of riding KDE. I was daily driving Neon (the official KDE distro) for about 2 years before I have had enough of the bloat and the general direction of the desktop env. I have a more and more stronger feeling that most of these projects are developed without an actual usecase. Which is fine of course, OSS is about scratching your own itch, not other's... but nowadays it's almost a sin to mention that something is buggy/unusable.

On the flip side, AwesomeWM or Xmonad users like us are stuck with Xorg for the foreseeable future. Maybe not a problem for here and now, but a concern in the long term for sure. Shame that the barrier to entry to creating an independent WM for Wayland is so high that very few exist yet and none that can substitute those two (yes I am aware of Sway).

Just FYI, XFCE has a dbus dependency, so it might not be what you are looking for if that's a problem for you.

Why do you think KDE is not configurable?

I don't, but it, nor any DE like it come close to customizability when compared with AwesomeWM. It's not just about settings are available, I can hook into and change whatever functions I like, add custom code easily, replace every single aspect of the interface, etc.

Can you give a specific example of what you could do with Awesome WM that you can't replicate easily with plasma 5 or an available extension?

Reply on news.ycombinator.com