▲ 27 ▼ BrokenPipe: a Steam vulnerability (0-Day) on Windows lets any normal user silently escalate to full SYSTEM privileges (github.com) submitted 1 week ago* by floofloof@lemmy.ca to c/cybersecurity@infosec.pub 5 comments fedilink hide all child comments
[–] zwerg@feddit.org 6 points 1 week ago (3 children) Why does steam need to run as system? I'm wondering what privileges steam needs on Linux... permalink fedilink source hideshow 3 child comments replies: [–] ohshit604@lemmy.halstead.host 2 points 1 week ago* (1 child) Why does steam need to run as system? I'm wondering what privileges steam needs on Linux Ever since I gotten myself a Steam Controller I’ve noticed my distro has restrictions on USB IO preventing the controller from being updated through the Steam client without root/sudoers access. The Steam client itself has never prompted for root access but the script used to update the controller certainly requires it, at least on Debian based distros, can’t say it’s like this for Arch based as that’s what SteamOS uses. permalink fedilink source parent hideshow 1 child comment replies: [–] med@sh.itjust.works 1 point 1 week ago* It's like that on Arch, and most everything by default. Standard practice - you often have to allow it explicitly via a group for unprivileged access to write to USB devices. If you've played with custom keyboards it's commonly an issue there. You wouldn't want just any old program or webpage sending custom firmware to your keyboard! permalink fedilink source parent [–] frongt@lemmy.zip 0 points 1 week ago It probably doesn't need to, but windows doesn't make it easy for services to drop privileges. permalink fedilink source parent
[–] ohshit604@lemmy.halstead.host 2 points 1 week ago* (1 child) Why does steam need to run as system? I'm wondering what privileges steam needs on Linux Ever since I gotten myself a Steam Controller I’ve noticed my distro has restrictions on USB IO preventing the controller from being updated through the Steam client without root/sudoers access. The Steam client itself has never prompted for root access but the script used to update the controller certainly requires it, at least on Debian based distros, can’t say it’s like this for Arch based as that’s what SteamOS uses. permalink fedilink source parent hideshow 1 child comment replies: [–] med@sh.itjust.works 1 point 1 week ago* It's like that on Arch, and most everything by default. Standard practice - you often have to allow it explicitly via a group for unprivileged access to write to USB devices. If you've played with custom keyboards it's commonly an issue there. You wouldn't want just any old program or webpage sending custom firmware to your keyboard! permalink fedilink source parent
[–] med@sh.itjust.works 1 point 1 week ago* It's like that on Arch, and most everything by default. Standard practice - you often have to allow it explicitly via a group for unprivileged access to write to USB devices. If you've played with custom keyboards it's commonly an issue there. You wouldn't want just any old program or webpage sending custom firmware to your keyboard! permalink fedilink source parent
[–] frongt@lemmy.zip 0 points 1 week ago It probably doesn't need to, but windows doesn't make it easy for services to drop privileges. permalink fedilink source parent
all 5 comments