diff options
| author | Danilo M. <danix@danix.xyz> | 2026-09-17 12:39:18 +0200 |
|---|---|---|
| committer | Danilo M. <danix@danix.xyz> | 2026-09-17 12:39:18 +0200 |
| commit | 729c7483ed9a71446bb3c8176c29e405109744a3 (patch) | |
| tree | 6e51029a55e14066f77c79d48e4ac625fd083093 | |
| parent | 5e3de7cbf39b54114244acbde998364b5b49ea24 (diff) | |
| download | sddm-theme-udt-729c7483ed9a71446bb3c8176c29e405109744a3.tar.gz sddm-theme-udt-729c7483ed9a71446bb3c8176c29e405109744a3.zip | |
docs: record accepted symlink trust in spec
| -rw-r--r-- | docs/superpowers/specs/2026-09-17-sddm-theme-udt-design.md | 26 |
1 files changed, 26 insertions, 0 deletions
diff --git a/docs/superpowers/specs/2026-09-17-sddm-theme-udt-design.md b/docs/superpowers/specs/2026-09-17-sddm-theme-udt-design.md index 0d9cff5..34104ce 100644 --- a/docs/superpowers/specs/2026-09-17-sddm-theme-udt-design.md +++ b/docs/superpowers/specs/2026-09-17-sddm-theme-udt-design.md @@ -143,6 +143,32 @@ between root-owned `theme.conf` (defaults, fallbacks) and user-owned `theme.conf.user` (live values) is exactly SDDM's documented override mechanism, not a trick. +### Security: the user-writable file + +`/usr/share/sddm/themes/udt/theme.conf.user` is a symlink into the login user's +home. This was raised during design and deliberately accepted. The reasoning: + +- **No code execution.** The file is INI parsed by `QSettings`. The only QML the + greeter runs is root-owned. +- **The reader is already untrusted.** SDDM runs the greeter as the unprivileged + `sddm` user and reaches the privileged helper over a socket that exposes only + login. A crafted config value does not yield root. +- **Only the owner can write it.** The file is owned by the login user; no other + local account can write it, and that user is already the machine owner. + +Accepted residual risks, both recorded rather than defended against: + +- **A path lever.** The writable file carries `background`, so it can point the + greeter's `Image` at any file the `sddm` user can read. The worst case is an + arbitrary image decode on the login screen. +- **Root scripts must not follow the link.** `rm -rf` and `chown -R` do not + follow symlinks, but `echo >`, `sed -i` and some archive tools do. The printed + root block uses only `ln -sfn` and `cp`, which do not write through the link. + Any future root command touching this path must keep that property. + +The stricter alternative, a root-created drop-box with an accent-only writable +file, was offered and declined in favour of the simpler spec. + ### Palette to UI mapping `udt-accent` writes under `[General]`: |