[Bug 31114] New: Wine is too insecure.
http://bugs.winehq.org/show_bug.cgi?id=31114 Bug #: 31114 Summary: Wine is too insecure. Product: Wine Version: unspecified Platform: x86 OS/Version: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: -unknown AssignedTo: wine-bugs(a)winehq.org ReportedBy: franchukrom(a)gmail.com Classification: Unclassified Program under wine can call Linux syscalls. The quick way to get the proof: compile this code: http://pastebin.com/NNxPcYxx with Windows version of nasm and run it under wine. It works. The program illustrates syscalls "write" (to print the message to a terminal) and "exit". But users of wine usually believe that their filesystems can't be damaged if they configure wine's drives not to point on files outside .wine. It is wrong: if malware developer is aware of wine, he can use Linux syscalls to have a full access to the whole computer with rights of user that ran wine. I think, wine should use chroot in order to avoid this problem. -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=31114 --- Comment #1 from Roman Franchuk <franchukrom(a)gmail.com> 2012-07-03 04:25:22 CDT --- fixed error in source for nasm: http://pastebin.com/kXHnL5NN -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=31114 Henri Verbeet <hverbeet(a)gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|UNCONFIRMED |RESOLVED Resolution| |INVALID --- Comment #2 from Henri Verbeet <hverbeet(a)gmail.com> 2012-07-03 05:13:45 CDT --- Wine doesn't pretend to be a sandbox. If people do get that impression that's unfortunate, but this is covered in e.g. the FAQ. If you want to sandbox applications you should probably use something along the lines of SELinux, like you would with any other Linux application. -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=31114 Austin English <austinenglish(a)gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |CLOSED Resolution|INVALID |WONTFIX --- Comment #3 from Austin English <austinenglish(a)gmail.com> 2012-07-03 13:27:13 CDT --- WONTFIX is more appropriate. -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.
participants (1)
-
wine-bugs＠winehq.org