Re: loader: more stringent sanity check
"Dan Kegel" <dank(a)kegel.com> writes:
+ if (!strcmp( argv[1], "--nosanitycheck" )) + { + perform_sanity_check = 0; + + /* Delete --nosanitycheck from argv */ + + /* Size of argv before is argc +1 for argv[0], +1 for argv[argc]=0 */ + /* Size of argv afterwards is one less */ + argv = malloc((argc + 1) * sizeof (char *)); + argv[0] = (*pargv)[0]; + memcpy(argv+1, *pargv + 2, argc * sizeof(char *)); /* final 0, too */ + argc--; + *pargc = argc; + *pargv = argv; + } + + if (perform_sanity_check && !geteuid()) + { + fprintf( stderr, "%s\n%s\n", + "Please don't run wine as root! See http://wiki.winehq.org/NoRoot", + usage ); + exit(1); + }
I hope you are not seriously suggesting that we do this... I'm not at all convinced that we need even a warning, there doesn't seem to be much concrete evidence that running as root is actually harmful, and it's necessary in many cases. Refusing to run is clearly not an option. If we really need to have something then it should be at most a one-time warning (in a message box so people have a chance to see it) at wineprefixcreate time, with an easy way to disable it. -- Alexandre Julliard julliard(a)winehq.org
On Thu, Mar 20, 2008 at 3:28 PM, Alexandre Julliard <julliard(a)winehq.org> wrote:
I hope you are not seriously suggesting that we do this...
Seriously.
I'm not at all convinced that we need even a warning, there doesn't seem to be much concrete evidence that running as root is actually harmful,
Many, many newbies are running wine as root without really needing to. They are much more likely to screw up their systems this way. Are you saying we should stop advising against this?
and it's necessary in many cases. Refusing to run is clearly not an option.
That's why the override is provided.
If we really need to have something then it should be at most a one-time warning (in a message box so people have a chance to see it) at wineprefixcreate time, with an easy way to disable it.
Then the newbies will just click past it. - Dan
Dan Kegel wrote:
On Thu, Mar 20, 2008 at 3:28 PM, Alexandre Julliard <julliard(a)winehq.org> wrote:
I hope you are not seriously suggesting that we do this...
Seriously.
I'm not at all convinced that we need even a warning, there doesn't seem to be much concrete evidence that running as root is actually harmful,
Many, many newbies are running wine as root without really needing to. They are much more likely to screw up their systems this way. Are you saying we should stop advising against this? They are working as root. They are screwed already! Though I would keep the warning.
and it's necessary in many cases. Refusing to run is clearly not an option.
That's why the override is provided.
If we really need to have something then it should be at most a one-time warning (in a message box so people have a chance to see it) at wineprefixcreate time, with an easy way to disable it.
Then the newbies will just click past it. Put in a timer forcing the people to read it for 10 to 20 seconds. If they click past that and still go on ... *shrug*. Welcome to the real world: they are screwed already so let them screw them self up a little bit more if they want. Freedom of choice.
bye michael
On Thu, Mar 20, 2008 at 3:55 PM, Michael Stefaniuc <mstefani(a)redhat.com> wrote:
If we really need to have something then it should be at most a one-time warning (in a message box so people have a chance to see it) at wineprefixcreate time, with an easy way to disable it.
Then the newbies will just click past it.
Put in a timer forcing the people to read it for 10 to 20 seconds. If they click past that and still go on ... *shrug*. Welcome to the real world: they are screwed already so let them screw them self up a little bit more if they want.
We want to minimize power user annoyance while also minimizing newbie system damage and number of posts in wine-users saying "never run wine as root". Four ideas are on the table: - do nothing (but then wine-users is intolerable) - just tell people in wine-users "don't tell people to not run wine as root" (but that's poor practice) - have wine abort (possibly with a gui warning) if run as root without --nosanitycheck (but that might annoy power users) - same, but put the check in wineprefixcreate (but newbies might bypass this) Although I suspect users will just bypass the check if it's only in wineprefixcreate, I'll code up that approach, it's better than nothing, and Alexandre might go for it. - Dan
Strictly speaking, running as root is a OS level issue, not a wine issue. That being said, wine is being friendly if it notes the possible issues with running as root. That being said, letting the user know the bypass switch or when wine doesn't start up right away is also friendly. Perhaps we should be telling newbies how run "not as root", but that's even further into the "it's not a wine issue" territory. -Buck On Thu, Mar 20, 2008 at 5:04 PM, Dan Kegel <dank(a)kegel.com> wrote:
On Thu, Mar 20, 2008 at 3:55 PM, Michael Stefaniuc <mstefani(a)redhat.com> wrote:
If we really need to have something then it should be at most a one-time warning (in a message box so people have a chance to see it) at wineprefixcreate time, with an easy way to disable it.
Then the newbies will just click past it.
Put in a timer forcing the people to read it for 10 to 20 seconds. If they click past that and still go on ... *shrug*. Welcome to the real world: they are screwed already so let them screw them self up a little bit more if they want.
We want to minimize power user annoyance while also minimizing newbie system damage and number of posts in wine-users saying "never run wine as root".
Four ideas are on the table: - do nothing (but then wine-users is intolerable) - just tell people in wine-users "don't tell people to not run wine as root" (but that's poor practice) - have wine abort (possibly with a gui warning) if run as root without --nosanitycheck (but that might annoy power users) - same, but put the check in wineprefixcreate (but newbies might bypass this)
Although I suspect users will just bypass the check if it's only in wineprefixcreate, I'll code up that approach, it's better than nothing, and Alexandre might go for it. - Dan
On Thu, Mar 20, 2008 at 4:11 PM, Christopher Buck <butterwell(a)gmail.com> wrote:
Strictly speaking, running as root is a OS level issue, not a wine issue.
Wine is a newbie magnet, though; it's what pulls a lot of Windows users onto this OS. So it's kind of our fault, it's best if we clean up the mess at the source...
On Thu, Mar 20, 2008 at 03:41:00PM -0700, Dan Kegel wrote:
On Thu, Mar 20, 2008 at 3:28 PM, Alexandre Julliard <julliard(a)winehq.org> wrote:
I hope you are not seriously suggesting that we do this...
Seriously.
I'm not at all convinced that we need even a warning, there doesn't seem to be much concrete evidence that running as root is actually harmful,
Many, many newbies are running wine as root without really needing to. They are much more likely to screw up their systems this way. Are you saying we should stop advising against this?
QUestion is ... Why do they do this? Ciao, Marcus
On Thu, Mar 20, 2008 at 4:28 PM, Marcus Meissner <marcus(a)jet.franken.de> wrote:
On Thu, Mar 20, 2008 at 03:41:00PM -0700, Dan Kegel wrote:
On Thu, Mar 20, 2008 at 3:28 PM, Alexandre Julliard <julliard(a)winehq.org> wrote:
I hope you are not seriously suggesting that we do this...
Seriously.
I'm not at all convinced that we need even a warning, there doesn't seem to be much concrete evidence that running as root is actually harmful,
Many, many newbies are running wine as root without really needing to. They are much more likely to screw up their systems this way. Are you saying we should stop advising against this?
QUestion is ... Why do they do this?
Ciao, Marcus
On Ubuntu, you cannot even login as root, they'd have to run "sudo wine". On many other distros, if you login as root, you'll get a dialog warning you about it, and the desktop background will be bright red. Are people going out of their way to run Wine as root?
On Thu, Mar 20, 2008 at 6:40 PM, Lei Zhang <thestig(a)google.com> wrote:
On Ubuntu, you cannot even login as root, they'd have to run "sudo wine". On many other distros, if you login as root, you'll get a dialog warning you about it, and the desktop background will be bright red. Are people going out of their way to run Wine as root?
I suspect it's more often people sudo'ing. I haven't tried it, but I know that Alexandre committed a fix that checks if you're running with sudo after the inital .wine directory is made, but I'm not sure about what happens if you do it initially. I.e., $ wineprefixcreate $ sudo wine notepad # gives an error about permissions but does: $ rm -rf ~/.wine $ sudo wine notepad give the same error (not at home or else I'd check). Something should be done regardless, I'd personally rather see a gui warning each time wine is run as root without a switch, but at least if it is done at wineprefixcreate, then it'll catch most (and the permissions check should catch those that run sudo on their user's .wine directory). Those two efforts combined should catch most issues, IMHO.
Austin English wrote:
On Thu, Mar 20, 2008 at 6:40 PM, Lei Zhang <thestig(a)google.com> wrote:
On Ubuntu, you cannot even login as root, they'd have to run "sudo wine". On many other distros, if you login as root, you'll get a dialog warning you about it, and the desktop background will be bright red. Are people going out of their way to run Wine as root?
I suspect it's more often people sudo'ing. I haven't tried it, but I know that Alexandre committed a fix that checks if you're running with sudo after the inital .wine directory is made, but I'm not sure about what happens if you do it initially. I.e., $ wineprefixcreate $ sudo wine notepad # gives an error about permissions
but does:
$ rm -rf ~/.wine $ sudo wine notepad
give the same error (not at home or else I'd check).
Something should be done regardless, I'd personally rather see a gui warning each time wine is run as root without a switch, but at least if it is done at wineprefixcreate, then it'll catch most (and the permissions check should catch those that run sudo on their user's .wine directory). Those two efforts combined should catch most issues, IMHO.
GUI warning won't work - in some configurations root does not have $DISPLAY defined. So if a users logs in as a normal user then tries to do "sudo wine" it will be limited to text terminal only. That btw is the main reason why we have to stop Wine from being run as a root. Vitaliy.
On Thu, Mar 20, 2008 at 09:48:31PM -0600, Vitaliy Margolen wrote:
Austin English wrote:
On Thu, Mar 20, 2008 at 6:40 PM, Lei Zhang <thestig(a)google.com> wrote:
On Ubuntu, you cannot even login as root, they'd have to run "sudo wine". On many other distros, if you login as root, you'll get a dialog warning you about it, and the desktop background will be bright red. Are people going out of their way to run Wine as root?
I suspect it's more often people sudo'ing. I haven't tried it, but I know that Alexandre committed a fix that checks if you're running with sudo after the inital .wine directory is made, but I'm not sure about what happens if you do it initially. I.e., $ wineprefixcreate $ sudo wine notepad # gives an error about permissions
but does:
$ rm -rf ~/.wine $ sudo wine notepad
give the same error (not at home or else I'd check).
Something should be done regardless, I'd personally rather see a gui warning each time wine is run as root without a switch, but at least if it is done at wineprefixcreate, then it'll catch most (and the permissions check should catch those that run sudo on their user's .wine directory). Those two efforts combined should catch most issues, IMHO.
GUI warning won't work - in some configurations root does not have $DISPLAY defined. So if a users logs in as a normal user then tries to do "sudo wine" it will be limited to text terminal only.
That btw is the main reason why we have to stop Wine from being run as a root.
And the question still stands, why they think "sudo root" is necessary for Wine ... We want to definitely fix the misconception in the users heads / documentation in the Internet. eg on http://appdb.winehq.org/objectManager.php?sClass=version&iId=9297&iTestingId... like google just gave me... *sigh* Ciao, Marcus
"Austin English" <austinenglish(a)gmail.com> writes:
I suspect it's more often people sudo'ing. I haven't tried it, but I know that Alexandre committed a fix that checks if you're running with sudo after the inital .wine directory is made, but I'm not sure about what happens if you do it initially. I.e., $ wineprefixcreate $ sudo wine notepad # gives an error about permissions
but does:
$ rm -rf ~/.wine $ sudo wine notepad
give the same error (not at home or else I'd check).
That's a good point, we could certainly prevent running wineprefixcreate as root in that case too, that would probably solve most of the problem. Then people have to explicitly login as root, and in that case I don't think we want a warning at all. -- Alexandre Julliard julliard(a)winehq.org
On Fri, Mar 21, 2008 at 3:37 AM, Alexandre Julliard <julliard(a)winehq.org> wrote:
"Austin English" <austinenglish(a)gmail.com> writes:
I suspect it's more often people sudo'ing. I haven't tried it, but I know that Alexandre committed a fix that checks if you're running with sudo after the inital .wine directory is made, but I'm not sure about what happens if you do it initially. I.e., $ wineprefixcreate $ sudo wine notepad # gives an error about permissions
but does:
$ rm -rf ~/.wine $ sudo wine notepad
Just tested this: $ wineprefixcreate $ sudo wine notepad Fails with 'wine: /home/austin/.wine is not owned by you' $ rm -rf ~/.wine $ sudo wineprefixcreate $ wine notepad Fails with 'wine: /home/austin/.wine is not owned by you' But: $ rm -rf ~/.wine $ sudo wine notepad Works fine. Until you attempt to run wine as a normal user at least...
That's a good point, we could certainly prevent running wineprefixcreate as root in that case too, that would probably solve most of the problem. Then people have to explicitly login as root, and in that case I don't think we want a warning at all.
Agreed. IMHO, we should not permit running wineprefixcreate with sudo (or any other wine commands), but if someone explicitly logs in as root, they (hopefully) know what they're doing. Running sudo on a current wine directory already issues a warning. While it may be paranoia based, I prefer to think of it as a preventative precaution, since in due time (if measures aren't taken) someone's bound to take a windows virus and screw up a *nix machine severely. Might as well prevent it early (especially well in advance of 1.0.0. It doesn't take much effort, and prevents a lot of headache.
On Fri, Mar 21, 2008 at 03:56:08AM -0500, Austin English wrote:
On Fri, Mar 21, 2008 at 3:37 AM, Alexandre Julliard <julliard(a)winehq.org> wrote: <snipped>
That's a good point, we could certainly prevent running wineprefixcreate as root in that case too, that would probably solve most of the problem. Then people have to explicitly login as root, and in that case I don't think we want a warning at all.
Agreed. IMHO, we should not permit running wineprefixcreate with sudo (or any other wine commands), but if someone explicitly logs in as root, they (hopefully) know what they're doing. Running sudo on a current wine directory already issues a warning. While it may be paranoia based, I prefer to think of it as a preventative precaution, since in due time (if measures aren't taken) someone's bound to take a windows virus and screw up a *nix machine severely. Might as well prevent it early (especially well in advance of 1.0.0. It doesn't take much effort, and prevents a lot of headache.
I recall seeing an application intended to be run only by normal user popping up a warning message if started by root. If I recall correctly it didn't prevent the app from running, but was just a warning against running the app as root unless you really, really have a good reason to, with a timer for a couple of seconds to allow the user to abort the opperation. If the user didn't do anything it would continue on after timeout. I think that would help avoid a lot users unnecessarily running wine as root. It would also get the message out that it's not necessary. -- Darragh "Nothing is foolproof to a sufficiently talented fool."
"Dan Kegel" <dank(a)kegel.com> writes:
Many, many newbies are running wine as root without really needing to. They are much more likely to screw up their systems this way. Are you saying we should stop advising against this?
I have seen very little evidence that anybody screwed up their system by running Wine as root, I think that's just paranoia. Of course it's possible in theory, but you can screw up your system by running 'cat' as root too, that doesn't mean it needs a warning. Pretty much the only case I'm aware of is someone's system rebooting because an app was searching through /proc and triggered the watchdog. That shouldn't be hard to avoid, and it's really minor compared to the thousands of people who reboot their box as normal users just by starting OpenGL. So yes, I'd say stop the "don't run as root" crusade, and fix the actual problems that running as root causes, if there are any. -- Alexandre Julliard julliard(a)winehq.org
participants (9)
-
Alexandre Julliard -
Austin English -
Christopher Buck -
Dan Kegel -
Darragh Bailey -
Lei Zhang -
Marcus Meissner -
Michael Stefaniuc -
Vitaliy Margolen