Re: Review of new English templates for wireshark

(Delayed by gmail declaring the original message to be spam)

Richard Lewis wrote:
> Bálint Réczey <[email protected]> writes:
>> Template: stratoshark/install-setuid
>> Type: boolean
>> Default: false
>> _Description: Should non-superusers be able to capture system calls?
> 
> is superusers the right term here? maybe "non-privileged users"? or
> "unprivileged"? or "users in the scap group" (i dont know what the
> answer is, but "superuser" seems a bit old-fashioned and unclear to me)

It's copying the existing template for wireshark, which asks
   Should non-superusers be able to capture packets?
It might be clearer just to say what privilege elevation mechanism
it's talking about.  (Researches details.)  Okay, no, it's a bit
complicated: setcap falling back on setuid.
 
>>  The falcodump external capture utility (extcap)
> 
> i found the bit in brackets bit a little confusing -- half the people
> will reads this as saying 'extcap' is the name of the utility and
> "falcodump" is an adjective, and the other half will read it as saying
> 'falcodump' is the name of the utility and extcap is <something else>. i
> dont think you need the "(extcap)" bit at all here?

I've used wireshark in the past, but I'd never heard of falcodump or
extcap or Stratoshark either.  What I always do in cases like this is
look for pages like
 https://manpages.debian.org/trixie/wireshark-common/falcodump.1.en.html
and in this case it turns out falcodump is "an extcap tool", and (phew)
that's got a man page too!
 https://manpages.debian.org/trixie/wireshark-common/extcap.4.en.html

>> can be installed in a
>>  way that allows members of the "scap" system group to capture system
>>  calls. This is recommended over the alternative of running Stratoshark
>>  directly as root, because less of the code will run with elevated
>>  privileges.
> 
> it's slightly confusing to introduce "Statoshark" here --- it would make
> sense if this say 'falcodump' instead? or if the first sentence said
> falcodump was part of Stratoshark (i am guessing)

manpages.debian.org has never heard of it.. ah, it's a new package in
experimental only.

Meanwhile, "scap" is another confusing piece of jargon.  It *isn't*
talking about the Security Content Automation Protocol, or indeed
setcap... there's a libscap, but it's hidden away in the package
libfalcosecurity0.  Presumably it stands for something-capture... aha:
 https://github.com/falcosecurity/libs/
expands it as "system capture".

> it's also slightly confusing because the title was "non-superusers",
> which suggests all users, not just those in the scap group. i think
> maybe the title should be changed?

The trouble is, it's asking "should there be a mechanism to allow
selected unprivileged users to run falcodump?", but the mechanism is
rather complicated.

>>  .
>>  For more detailed information please see
>>  /usr/share/doc/wireshark-common/README.Debian.

Thats README.Debian.gz.  I also notice that it recommends using
	sudo usermod a -G wireshark {username}
which isn't the Debian Way - you can just say
	sudo adduser {username} wireshark

>>  .
>>  Enabling this feature may be a security risk, so it is disabled by
>>  default. If in doubt, it is suggested to leave it disabled.
>>
> 
> i found this bit completely baffling -- the text strongly suggested to
> me that enable would mean "members of scap group can run falcodump" and
> disabled meant "you have to run this as root". This is because of the
> sentence "This is recommended" coming after a sentence about using the
> scap group. so basically you seem to say it's recommended to enable and
> then recommend non-experts leaving it disabled. Either this last
> sentence is wrong, or the earlier text needs changing to explain the
> choice better

Yes, the recommendations seem contradictory, here and indeed in the
similar wireshark template.
 
>> Template: stratoshark/addgroup-failed
>> Type: error
>> _Description: Creating the "scap" system group failed
>>  The "scap" group does not exist, and creating it failed, so
>>  Stratoshark cannot be configured to capture system calls as an unprivileged
>>  user.
> 
> (i think this suggests that "unprivieged user" or "users in the scap
> group" should be used in the first template)

"Non-superusers" was probably chosen because it's shorter than
"unprivileged users", though not by much.

>>  .
>>  Please create the "scap" system group and try configuring
>>  stratoshark again.
>>
>> Template: stratoshark/group-is-user-group
>> Type: error
>> _Description: The "scap" group is a system group
>>  The "scap" group exists as a user group, but the preferred
>>  configuration is for it to be created as a system group.
> 
> i think this would be clearer without the word "created", because you
> dont actualy care if it already exists as a system group

In fact it strikes me as a bad idea to use a system group name as
short as "scap", given that there must be plenty of people out there
with evil kid brothers named "Steve Cap".  Shouldn't it be called
something like "_libscap"?

(Now I'm daydreaming about how much better things would be if there
was some sort of Free Software Namespace Regulation Agency out there
to prevent overabbreviated names like this.  It's not as if end users
will ever need to type it in a hurry; would the developers really have
died of Repetitive Strain Injury if it was "libsystemcapture"?)

>>  .
>>  As a result, purging stratoshark will not remove the "scap"
>>  group, but everything else should work properly.
>> ---

"Or as well as it ever does."