Re: Games Team policy on games being setgid

On Tue, 30 Dec 2025 at 20:47:37 +0100, Alexandre Detiste wrote:
>Le mar. 30 déc. 2025 à 12:07, Simon McVittie <[email protected]> a écrit :
>> [Roguelikes] are the reason I didn't simply suggest forbidding setgid: I
>> suspect that for some of them, we'll need to leave the game (or a
>> wrapper) setgid in Debian 14 'forky', so that it can copy saved games in
>> progress to the user's home directory on startup, so that they can still
>> be played after we finally remove setgid

Note that if the saved games are world-*readable*, this doesn't require 
keeping setgid: we only need setgid if they are intentionally made 
unreadable by non-members of the games group as a form of 
tamper-proofing or to avoid spoilers. (Does anything do this? I haven't 
found an example yet.)

>I was think of having maintainer scripts moving the file arbitrarily
>to $("getent passwd 1000  | cut -d : -f 6")/.$game

Yeah, please don't do that. Let's not solve a theoretical security issue 
(privilege escalation to a group that doesn't own anything particularly 
important) by creating actual security issues (maintainer scripts 
writing into home directories seem like a source of symlink attacks).

     smcv