Gentoo Forums
Gentoo Forums
Gentoo Forums
Quick Search: in
Gentoo and the `games' group
View unanswered posts
View posts from last 24 hours

 
Reply to topic    Gentoo Forums Forum Index Gamers & Players
View previous topic :: View next topic  
Author Message
Dolda2000
n00b
n00b


Joined: 05 Mar 2004
Posts: 37
Location: Täby, Sweden

PostPosted: Wed Jun 08, 2005 1:37 am    Post subject: Gentoo and the `games' group Reply with quote

Hi Gentoo lovers!

I'd be glad if someone could answer a question that has had me flabbergasted since I first installed Gentoo: Why does Gentoo completely break the `games' group?

As we all know, the traditional use of the games group is to enable games to keep a system-wide highscore that cannot be modified by any user by being SGID games. A pretty nifty feature, if you ask me. Every distro except Gentoo that I've ever seen does this.

Gentoo, however, completely ignores this and not only does not set SGID games on game executables, but also requires users to actually be in the games group to be allowed to even play games. This not only breaks highscore keeping for games that are executable by those outside the games group (e.g. gnome-games), but also makes it more than just a little ugly to have Gentoo interoperate with other distros. If I'm having a user in the games group on my NIS server, so that he can play games on Gentoo machines, he can also edit the highscore files on non-Gentoo machines. Admittedly, that's not exactly a first priority security breach, but it is most certainly ugly.

So again, my question is: Why? It seems fairly worthless anyway, since if a user wants to play a game, he can just download the source and compile it himself either way, so it doesn't exactly stop anyone anyway...

I'd also like to pose a second question: Is it possible to revert this for all games packages in some easy way?
Back to top
View user's profile Send private message
-=GGW=- $ol!d $n4>|e
Veteran
Veteran


Joined: 12 Apr 2004
Posts: 1604
Location: USA

PostPosted: Wed Jun 08, 2005 1:59 am    Post subject: Reply with quote

I think having a games groupo is very usefull, it discourages anyone who you dont want playing games from playing them, also, why shouldn't gentoo reign superior over other ddistros high scores.. :lol:
Back to top
View user's profile Send private message
makomk
n00b
n00b


Joined: 15 Jul 2005
Posts: 45
Location: Not all there

PostPosted: Sat Aug 13, 2005 2:22 pm    Post subject: Reply with quote

I can't seem to find an official answer to this question. Does anyone know why the Gentoo developers decided to give the "games" group a different meaning from the more usual one?

As Dolda200 said, it does seem pretty pointless to restrict who can run games (at least in the default setup - a few people might find it useful). It's also a bit confusing, and ignores what I gather is a long-standing tradition of using setgid game executables to protect high score tables from tampering.
Back to top
View user's profile Send private message
andrewd18
Guru
Guru


Joined: 11 Apr 2004
Posts: 364
Location: Wisconsin, USA

PostPosted: Sat Aug 13, 2005 6:57 pm    Post subject: Reply with quote

Quote:
I can't seem to find an official answer to this question. Does anyone know why the Gentoo developers decided to give the "games" group a different meaning from the more usual one?


BECAUSE GAMES ARE BAD. I DON'T WANT PEOPLE IN MY HOUSEHOLD PLAYING ANYTHING AT ALL. NOT DOOM3, NOT TUXRACER, NOT EVEN FSCKING GNOBOTS. SO THERE.

On a serious note, does it really break the games group? Does the games group even have any meaning outside of Gentoo (I can play games in SUSE whether or not I'm in the games group...)?

~~ Andrew D.
_________________
Keep Your Toolchain Stable! - emwrap.sh

There's no place like ::1
Back to top
View user's profile Send private message
Aynjell
Veteran
Veteran


Joined: 28 Jun 2004
Posts: 1117

PostPosted: Sat Aug 13, 2005 7:08 pm    Post subject: Reply with quote

Isn't games group basically just putting /usr/games/bin into your path?
_________________
CPU: 3800+ X2 (2.5Ghz)
GPU: eVGA 7600GT (640/1700)
MOBO: DFI SLI-DR (Surprisingly good!)
RAM: 2 x OCZ Gold 1024 DDR500 3-4-3-7 (2048)
HDD: Western Digital Raptor
Back to top
View user's profile Send private message
makomk
n00b
n00b


Joined: 15 Jul 2005
Posts: 45
Location: Not all there

PostPosted: Sun Aug 14, 2005 4:32 pm    Post subject: Reply with quote

Aynjell wrote:
Isn't games group basically just putting /usr/games/bin into your path?


No. Adding someone to the games group may add /usr/games/bin to the user's path (though I think it's there anyway), but the main purpose is to allow them to actually execute the games. If you
Code:
ls -l /usr/games/bin/

you'll see that only root and members of the games group have execute permissions for the games, which means that they are the only ones who can run them. (Also note that users who aren't in the games group will probably find games don't turn up in shell command completion, even if /usr/games/bin is in their path, because the games aren't executable.)
Back to top
View user's profile Send private message
UncleOwen
Veteran
Veteran


Joined: 27 Feb 2003
Posts: 1493
Location: Germany, Hamburg

PostPosted: Sun Aug 14, 2005 8:54 pm    Post subject: Reply with quote

andrewd18 wrote:
On a serious note, does it really break the games group? Does the games group even have any meaning outside of Gentoo (I can play games in SUSE whether or not I'm in the games group...)?


Yes, it does. Read Dolda2000's post.
Back to top
View user's profile Send private message
bunder
Bodhisattva
Bodhisattva


Joined: 10 Apr 2004
Posts: 5213

PostPosted: Sun Aug 14, 2005 9:33 pm    Post subject: Reply with quote

how does it break it? the games group is in the users group (or at least it is on my system). see the /etc/group file.
_________________
goodbye fgo. it was nice knowing you.
Back to top
View user's profile Send private message
UncleOwen
Veteran
Veteran


Joined: 27 Feb 2003
Posts: 1493
Location: Germany, Hamburg

PostPosted: Sun Aug 14, 2005 10:06 pm    Post subject: Reply with quote

Yes, games is in users. I don't see your point.
Back to top
View user's profile Send private message
reub2000
Guru
Guru


Joined: 31 Jan 2004
Posts: 362

PostPosted: Sun Aug 14, 2005 10:26 pm    Post subject: Reply with quote

Quote:
So again, my question is: Why? It seems fairly worthless anyway, since if a user wants to play a game, he can just download the source and compile it himself either way, so it doesn't exactly stop anyone anyway...


Mount all partitions that have places that the user can write to with the noexec option. An extreme solution to stop a user from playing games, but I think it would work.
Back to top
View user's profile Send private message
bunder
Bodhisattva
Bodhisattva


Joined: 10 Apr 2004
Posts: 5213

PostPosted: Mon Aug 15, 2005 12:50 am    Post subject: Reply with quote

UncleOwen wrote:
Yes, games is in users. I don't see your point.


Mine, or the original posters?
_________________
goodbye fgo. it was nice knowing you.
Back to top
View user's profile Send private message
UncleOwen
Veteran
Veteran


Joined: 27 Feb 2003
Posts: 1493
Location: Germany, Hamburg

PostPosted: Mon Aug 15, 2005 2:14 pm    Post subject: Reply with quote

Yours.
Back to top
View user's profile Send private message
bunder
Bodhisattva
Bodhisattva


Joined: 10 Apr 2004
Posts: 5213

PostPosted: Tue Aug 16, 2005 12:38 am    Post subject: Reply with quote

any user in the users group is automatically in the games group. i fail to see how the games group is broken.
_________________
goodbye fgo. it was nice knowing you.
Back to top
View user's profile Send private message
UncleOwen
Veteran
Veteran


Joined: 27 Feb 2003
Posts: 1493
Location: Germany, Hamburg

PostPosted: Tue Aug 16, 2005 8:59 am    Post subject: Reply with quote

beugh wrote:
any user in the users group is automatically in the games group.

No, it's the other way 'round. But even that would be broken (in the sense discussed in this thread), because no one should be in the games group.
Back to top
View user's profile Send private message
Ibn al-Hazardous
Tux's lil' helper
Tux's lil' helper


Joined: 02 Sep 2004
Posts: 133
Location: Somewhere deep in the desert.

PostPosted: Tue Aug 16, 2005 1:10 pm    Post subject: Reply with quote

beugh wrote:
any user in the users group is automatically in the games group. i fail to see how the games group is broken.


The point is: No user should be in the games group, because users should not be allowed to edit hiscores by hand. Only game executables should do that, and therefore only game executables should be "in the games group". That way, hiscores etc can be shared computerwide. But sharing users via NIS makes it awkward to retain this feature of every other (larger than tiny) distro, if you want to allow a user to play games on gentoo.
_________________
/Ibn
Back to top
View user's profile Send private message
bunder
Bodhisattva
Bodhisattva


Joined: 10 Apr 2004
Posts: 5213

PostPosted: Wed Aug 17, 2005 1:08 am    Post subject: Reply with quote

Ibn al-Hazardous wrote:
The point is: No user should be in the games group, because users should not be allowed to edit hiscores by hand. Only game executables should do that, and therefore only game executables should be "in the games group". That way, hiscores etc can be shared computerwide.


Then why does portage tell you...

Quote:

* Remember, in order to play games, you have to
* be in the 'games' group.


:?:

This has been the default behaviour since I started using gentoo almost 2 years ago.

Maybe this should belong in "Portage and Programming" instead of "Games and Players". If you really feel that this is a security issue, how about making the world a patch or something? Instead of bitching about it, fix it! I still fail to see how this is a REAL problem. It's a high-score file for fsck's sakes, not something important like your boot configuration.
_________________
goodbye fgo. it was nice knowing you.
Back to top
View user's profile Send private message
Dolda2000
n00b
n00b


Joined: 05 Mar 2004
Posts: 37
Location: Täby, Sweden

PostPosted: Thu Sep 15, 2005 1:32 am    Post subject: Reply with quote

beugh wrote:
Then why does portage tell you...

Quote:

* Remember, in order to play games, you have to
* be in the 'games' group.


Because Gentoo requires it. My point from the beginning was that Gentoo is the only distro that does this. All other distros, and all other flavors of Unix as well (as far as I know, at least) don't do this. What they do is having the games group reserved for game executables, which are SGID games. Therefore, the game executables alone can edit the hiscore files. Like Ibn-al Hazardour said, this is an especially large problem when sharing passwd directory info over NIS or similar.

beugh wrote:
This has been the default behaviour since I started using gentoo almost 2 years ago.

Maybe this should belong in "Portage and Programming" instead of "Games and Players". If you really feel that this is a security issue, how about making the world a patch or something? Instead of bitching about it, fix it! I still fail to see how this is a REAL problem. It's a high-score file for fsck's sakes, not something important like your boot configuration.

Isn't "being ugly" enough reason to fix something? I would fix it myself, but I'd like to hear the opinion of the Gentoo devs first, to see why they did it the way they did, breaking all of Unix gaming tradition. There's no point in submitting a patch if the devs have their own opinions and won't accept it.
Back to top
View user's profile Send private message
BlackEdder
Advocate
Advocate


Joined: 26 Apr 2004
Posts: 2588
Location: Dutch enclave in Egham, UK

PostPosted: Thu Sep 15, 2005 10:05 am    Post subject: Reply with quote

I think the best way to go about this is to post a bug report assigned to the games group, they should tell you why it was decided to do it this way. You could also try to email them directly.

Posting here won't help, because the devs rarely read the fora.
Back to top
View user's profile Send private message
Display posts from previous:   
Reply to topic    Gentoo Forums Forum Index Gamers & Players All times are GMT
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum