From 729c7483ed9a71446bb3c8176c29e405109744a3 Mon Sep 17 00:00:00 2001 From: "Danilo M." Date: Thu, 17 Sep 2026 12:39:18 +0200 Subject: docs: record accepted symlink trust in spec --- .../specs/2026-09-17-sddm-theme-udt-design.md | 26 ++++++++++++++++++++++ 1 file changed, 26 insertions(+) (limited to 'docs/superpowers/specs/2026-09-17-sddm-theme-udt-design.md') diff --git a/docs/superpowers/specs/2026-09-17-sddm-theme-udt-design.md b/docs/superpowers/specs/2026-09-17-sddm-theme-udt-design.md index 0d9cff5..34104ce 100644 --- a/docs/superpowers/specs/2026-09-17-sddm-theme-udt-design.md +++ b/docs/superpowers/specs/2026-09-17-sddm-theme-udt-design.md @@ -143,6 +143,32 @@ between root-owned `theme.conf` (defaults, fallbacks) and user-owned `theme.conf.user` (live values) is exactly SDDM's documented override mechanism, not a trick. +### Security: the user-writable file + +`/usr/share/sddm/themes/udt/theme.conf.user` is a symlink into the login user's +home. This was raised during design and deliberately accepted. The reasoning: + +- **No code execution.** The file is INI parsed by `QSettings`. The only QML the + greeter runs is root-owned. +- **The reader is already untrusted.** SDDM runs the greeter as the unprivileged + `sddm` user and reaches the privileged helper over a socket that exposes only + login. A crafted config value does not yield root. +- **Only the owner can write it.** The file is owned by the login user; no other + local account can write it, and that user is already the machine owner. + +Accepted residual risks, both recorded rather than defended against: + +- **A path lever.** The writable file carries `background`, so it can point the + greeter's `Image` at any file the `sddm` user can read. The worst case is an + arbitrary image decode on the login screen. +- **Root scripts must not follow the link.** `rm -rf` and `chown -R` do not + follow symlinks, but `echo >`, `sed -i` and some archive tools do. The printed + root block uses only `ln -sfn` and `cp`, which do not write through the link. + Any future root command touching this path must keep that property. + +The stricter alternative, a root-created drop-box with an accent-only writable +file, was offered and declined in favour of the simpler spec. + ### Palette to UI mapping `udt-accent` writes under `[General]`: -- cgit v1.2.3