Re: Review of new English templates for wireshark

Bálint Réczey <[email protected]> writes:

> Hi,
>
> I would like to add the following new template to the wireshark source package:
>
> ---
> Template: stratoshark/install-setuid
> Type: boolean
> Default: false
> _Description: Should non-superusers be able to capture system calls?

is superusers the right term here? maybe "non-privileged users"? or
"unprivileged"? or "users in the scap group" (i dont know what the
answer is, but "superuser" seems a bit old-fashioned and unclear to me)

>  The falcodump external capture utility (extcap)

i found the bit in brackets bit a little confusing -- half the people
will reads this as saying 'extcap' is the name of the utility and
"falcodump" is an adjective, and the other half will read it as saying
'falcodump' is the name of the utility and extcap is <something else>. i
dont think you need the "(extcap)" bit at all here?

> can be installed in a
>  way that allows members of the "scap" system group to capture system
>  calls. This is recommended over the alternative of running Stratoshark
>  directly as root, because less of the code will run with elevated
>  privileges.

it's slightly confusing to introduce "Statoshark" here --- it would make
sense if this say 'falcodump' instead? or if the first sentence said
falcodump was part of Stratoshark (i am guessing)

it's also slightly confusing because the title was "non-superusers",
which suggests all users, not just those in the scap group. i think
maybe the title should be changed?
>  .
>  For more detailed information please see
>  /usr/share/doc/wireshark-common/README.Debian.
>  .
>  Enabling this feature may be a security risk, so it is disabled by
>  default. If in doubt, it is suggested to leave it disabled.
>

i found this bit completely baffling -- the text strongly suggested to
me that enable would mean "members of scap group can run falcodump" and
disabled meant "you have to run this as root". This is because of the
sentence "This is recommended" coming after a sentence about using the
scap group. so basically you seem to say it's recommended to enable and
then recommend non-experts leaving it disabled. Either this last
sentence is wrong, or the earlier text needs changing to explain the
choice better



> Template: stratoshark/addgroup-failed
> Type: error
> _Description: Creating the "scap" system group failed
>  The "scap" group does not exist, and creating it failed, so
>  Stratoshark cannot be configured to capture system calls as an unprivileged
>  user.

(i think this suggests that "unprivieged user" or "users in the scap
group" should be used in the first template)

>  .
>  Please create the "scap" system group and try configuring
>  stratoshark again.
>
> Template: stratoshark/group-is-user-group
> Type: error
> _Description: The "scap" group is a system group
>  The "scap" group exists as a user group, but the preferred
>  configuration is for it to be created as a system group.

i think this would be clearer without the word "created", because you
dont actualy care if it already exists as a system group

>  .
>  As a result, purging stratoshark will not remove the "scap"
>  group, but everything else should work properly.
> ---
>
> The proposed change is staged at:
> https://salsa.debian.org/rbalint/wireshark/-/commits/debian/experimental
>
> Please let me know if the change needs further adjustments.
>
> Cheers,
> Balint