[fixed in 1.0.3.8] fingerterm runs with elevated privileges (EGID != GID) [answered]
asked 2014-01-04 12:01:50 +0300
Typing id in fingerterm reveals that it (and its shell) runs with gid=100000 (nemo) but egid=998 (privileged)
Now this seems to be the norm for most apps (mail, weather) but I think it is not a good idea for a command shell to start with (albeit slightly) elevated privileges
Moreover, perl notices the fact and switches to tainted mode, becoming too paranoid to be usable: (Insecure $ENV{PATH} while running setgid)
I found a solution, adapting (or cloning) /usr/share/applications/fingerterm.desktop to make it run a tiny script:
#!/bin/zsh # sorry, zsh user here...
EGID=$GID # drop elevated privileges (may not work in bash?)
cd # solve the "starting in root directory" problem while we're at it
exec fingerterm
This works, but I think this should be fixed by Jolla eventually
In an ssh connection:
so what's the need for egid=998?
jsiren ( 2014-01-04 12:05:19 +0300 )@jsiren: When using ssh the problem doesn't arise: then egid=gid. But apparently most apps (including fingerterm) are started with an EGID=998, which may be useful for them, but is unnecessary for a command shell.
hlub ( 2014-01-04 12:10:16 +0300 )