Please stop packaging the Desktop client with a setuid root chrome

您所在的位置：网站首页 › bitwarden on f › Please stop packaging the Desktop client with a setuid root chrome

Please stop packaging the Desktop client with a setuid root chrome

2023-04-07 01:46| 来源: 网络整理| 查看: 265

Steps To Reproduce

Check out the RPM scripts for the latest (as of today) RPM:

$ rpm -qp --scripts https://github.com/bitwarden/clients/releases/download/desktop-v2023.3.1/Bitwarden-2023.3.1-x86_64.rpm

Expected Result

An RPM scriptlet that doesn't run chmod 4755 '/opt/Bitwarden/chrome-sandbox'

Actual Result $ rpm -qp --scripts https://github.com/bitwarden/clients/releases/download/desktop-v2023.3.1/Bitwarden-2023.3.1-x86_64.rpm postinstall scriptlet (using /bin/sh): #!/bin/bash # Link to the binary ln -sf '/opt/Bitwarden/bitwarden' '/usr/bin/bitwarden' # SUID chrome-sandbox for Electron 5+ chmod 4755 '/opt/Bitwarden/chrome-sandbox' || true update-mime-database /usr/share/mime || true update-desktop-database /usr/share/applications || true postuninstall scriptlet (using /bin/sh): #!/bin/bash # Delete the link to the binary rm -f '/usr/bin/bitwarden' Screenshots or Videos

No response

Additional Context

Electron has long since stopped needing a setuid root chrome sandbox. The AppImage doesn't appear to have a setuid root chrome-sandbox. I believe its only electron 5 and less that needed it, but it still warns about it. Please see:

https://bugs.chromium.org/p/chromium/issues/detail?id=598454

I also checked the .deb file, and I see a very similar script that sets chrome-sandbox as 4755 in the deb postinst script.

Removing the setuid bits on the RPM will still permit the package to run, and also changing the permissions on a packaged RPM causes it to fail RPM integrity verification, which will show up on some security scans. It really doesn't make sense to do this for all RPM and DEB distros just to support an out of date method of setting up namespaces.

Operating System

Linux

Operating System Version

Fedora Linux 37 x86_64

Installation method

Other

Build Version

2023.3.1

Issue Tracking Info I understand that work is tracked outside of Github. A PR will be linked to this issue should one be opened to address it, but Bitwarden doesn't use fields like "assigned", "milestone", or "project" to track progress.

【本文地址】

Please stop packaging the Desktop client with a setuid root chrome

Please stop packaging the Desktop client with a setuid root chrome

今日新闻

推荐新闻