0

lately I've been using the guest session on my xubuntu install because I am lazy and I was wondering what the security implications can be on the rest of the system if there is a web browser exploit or similar attack. Apparently it wipes the entire guest session every time you log out or it goes idle. Would a better alternative be just a regular user account?

2

Let's get into the details of what a guest session is on Ubuntu. You've asked 'is it more secure for the system to use a guest session rather a normal account?', and the answer is yes, but only slightly.

Guest sessions use a tmpfs instead of a home, so data does not get written to disk but stays in RAM. This means a prolongated session with important amounts of changes might cause your system to need swapping.

As far as I understand a user is created and deleted every time, albeit I haven't found the corresponding code in LightDM and the guest-sessions tree on Launchpad.

Processes in the session can only create TCP and UDP connections, although I'm not sure what the expected security benefits are (apart from preventing PPTP tunnels?).

AppArmor is used to ensure that this session cannot possibly write to the system, except for its own home and /tmp. This should normally cover cases when a root privilege escalation occurs within the guest session, but not attacks against the kernel itself. A regular account would not provide you with this kind of protection.

https://wiki.ubuntu.com/DesktopTeam/Specs/Intrepid/GuestAccount

-1

Yes, it wipes the whole session (more concretely, the $HOME of the guest user). An attacker would need to enter into another account (either root or eg. a normal user with a weak password).

Unless it manages to do so, any change will disappear on logout, which is nice for security, but inconvenient for users.

However, that things are wiped doesn't mean they that -if filesystem permissions allow them to- it couldn't write files on other locations, or send away data about your system.

Would a better alternative be just a regular user account?

As an alternative to what? For running browser exploits? No.

For normal Xubuntu usage? Probably. It will depend what you want to do there.

  • Guest sessions on Ubuntu are designed so that they are governed by AppArmor rules which prevent writing on the OS. This means that at the end of the day the identity the attacker retrieves matters little, provided the rules are well written and cover root capabilities to prevent further escalations. – Steve Dodier-Lazaro Sep 27 '14 at 11:03
  • Same comment for filesystem permissions: it's documented that those permissions are not provided, and you should provide links to this documentation rather than saying "it's forbidden unless it's allowed". – Steve Dodier-Lazaro Sep 27 '14 at 12:09
  • @Steve-DL I'm sure. I'm not sure what you mean by "filesystem permissions are not provided" (link?). The fs permissions will apply, althouth perhaps AppArmor will further restrict that, I haven't checked its config. I was thinking in a publicly readable /home/user or keeping files on /var/tmp (it is possible that AppArmor forbids it, but I'm sure it would break legit apps). Equally, I'm sure there could be data to exfiltrate based just on hostname, or the network access. Could you provide a link to the AppArmor policy affecting guests? – Ángel Sep 30 '14 at 12:51
  • Follow the URL on my answer above. The design spec from Canonical states: "Use AppArmor rules to completely hide /home, and give read-only access to /boot, /etc, /lib*, /opt, /root, /sbin, /srv, /usr, /var. " – Steve Dodier-Lazaro Sep 30 '14 at 16:49
  • The whole session is into a tmpfs (a file system emulated inside the RAM) and the rest of /home with other users' data is hidden (AppArmor again). That's actually why they have a single entry point in the form of a script separated from gdm/LightDM, so the AppArmor policy is enforced on that script and then propagated to created processes, as far as I understand it. – Steve Dodier-Lazaro Sep 30 '14 at 16:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.