27
BrokenPipe: a Steam vulnerability (0-Day) on Windows lets any normal user silently escalate to full SYSTEM privileges (github.com)
submitted 1 week ago* by to c/cybersecurity@infosec.pub
5 comments fedilink hide all child comments
 
you are viewing a single comment's thread
view the rest of the comments
[–] 6 points 1 week ago (3 children)

Why does steam need to run as system? I'm wondering what privileges steam needs on Linux...

  • permalink
  • fedilink
  • source
  • hideshow 3 child comments
    •
  • [–] 2 points 1 week ago* (1 child)

    Why does steam need to run as system? I'm wondering what privileges steam needs on Linux

    Ever since I gotten myself a Steam Controller I’ve noticed my distro has restrictions on USB IO preventing the controller from being updated through the Steam client without root/sudoers access. The Steam client itself has never prompted for root access but the script used to update the controller certainly requires it, at least on Debian based distros, can’t say it’s like this for Arch based as that’s what SteamOS uses.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 1 week ago*

    It's like that on Arch, and most everything by default. Standard practice - you often have to allow it explicitly via a group for unprivileged access to write to USB devices.

    If you've played with custom keyboards it's commonly an issue there. You wouldn't want just any old program or webpage sending custom firmware to your keyboard!

  • permalink
  • fedilink
  • source
  • parent