Chrome should create empty NativeMessagingHosts folder
Reported by
ja...@agilebits.com,
May 23 2017
|
|||||
Issue descriptionUserAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_4) AppleWebKit/604.1.22 (KHTML, like Gecko) Version/10.2 Safari/604.1.22 Steps to reproduce the problem: 1. Install and launch Chrome 2. Open ~/Library/Application Support/Google/Chrome What is the expected behavior? See empty NativeMessagingHosts folder What went wrong? No NativeMessagingHosts folder Did this work before? N/A Chrome version: Version 58.0.3029.110 (64-bit) Channel: stable OS Version: OS X 10.12.4 Flash Version: If the first Native Messaging application that is installed creates the NativeMessagingHosts folder as part of an installer that runs with escalated privileges, it will create it as owned by root:staff with 755 permissions. As a result, other apps that may need to install a Native Messaging Host manifest JSON file are blocked from writing to the folder without also requesting escalated privileges. If Chrome were to create this folder with the proper privileges from the start, then installers would have less occasion to create the folder and thus avoid creating it with incorrect permissions.
,
May 25 2017
,
May 25 2017
It looks wrong to me that an installer that runs with escalated privileges creates anything in user's home directory. If something is being installed system-wide then it should install the manifest in /Library/Google/Chrome/NativeMessagingHosts (which is accessible only to root). If the app is being installed for a specific user then the installer shouldn't need escalation. Even if we fix the permissions for this folder you'd still have a root-owned file in user's home directory, which seems wrong. This looks like a problem that needs to be fixed in the installer. Do you have an example of an installer that has this problem?
,
May 25 2017
https://abr.gov.au/AUSkey/Help-and-support/Setting-up-AUSkey-troubleshooting/Download-software-for-AUSkey/ I have reached out to them but gotten nothing other than the automated response.
,
Jun 2 2017
mark@, borisv@ - wondering if you have an idea what code might be doing this. I see the folder path defined in a header but I don't see anywhere that uses that path to create the folder.
,
Jun 2 2017
How about this script: https://cs.chromium.org/chromium/src/remoting/tools/register_local_nm_hosts.sh and the package https://cs.chromium.org/chromium/src/remoting/host/installer/mac/ChromotingHostService.pkgproj The package seems a bit suspicious.
,
Jun 13 2017
Taking this out of the Mac bug queue, feel free to reassign.
,
Jun 13 2017
Anything under src/remoting is unrelated to this bug. This bug is about a workaround for an issue in some third-party software which installs user-level native messaging hosts from an installer that runs as root and doesn't set proper owner user/group for the directory it creates in the user's home directory (~/Library/Application Support/Google/Chrome/NativeMessagingHosts). I'm not sure what's the right time to create these directory.
,
Jun 29 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/244c7782b827473cd835d14283743c76888e039a commit 244c7782b827473cd835d14283743c76888e039a Author: Sergey Ulanov <sergeyu@chromium.org> Date: Thu Jun 29 21:56:41 2017 Create NativeMessagingHosts directory on first run. Some third-party software creates NativeMessagingHosts directory with incorrect owner. Creating it on first run makes it less likely for this problem to occur. BUG= 725513 Change-Id: I32361ec07af63fe039ccb86396e390b6c2edb423 Reviewed-on: https://chromium-review.googlesource.com/537534 Reviewed-by: Jochen Eisinger <jochen@chromium.org> Commit-Queue: Sergey Ulanov <sergeyu@chromium.org> Cr-Commit-Position: refs/heads/master@{#483505} [modify] https://crrev.com/244c7782b827473cd835d14283743c76888e039a/chrome/browser/chrome_browser_main.cc
,
Jun 29 2017
thanks so much Sergey!
,
Jun 29 2017
|
|||||
►
Sign in to add a comment |
|||||
Comment 1 by lgrey@chromium.org
, May 24 2017