search

linkedin / qark

Tool to look for several security related Android application vulnerabilities
Other
3.2k stars 643 forks source link

Don't store decompilers and reports in LIB_PATH directory #237

Closed nafuti closed 5 years ago

nafuti commented 6 years ago

I noticed the apktool, dex2jar and procyon are downloaded and saved to the LIB_PATH that requires root privileges to execute. This means that to run QARK i'll always need to use sudo or run it as root. This also mean the folders and files in the build directory will be owned by root. I would suggest moving these to probably a user's local folder like ~/.qark/decompilers or if downloaded to the LIB_PATH, permission be granted to be executed by any other user.

Same goes for the report, maybe the report folder should either be saved in ~/.qark/reportsor to the CWD where qark was invoked or right next to where the build--build-path` is.

That's mostly what i found that invoked elevated privileges yet they were not needed.

nwalsh1995 commented 6 years ago

Thanks @nafuti, I think we have some issues due to installing with pip since it puts our code into 'site-packages'. I am guessing you installed the v2 outside of a virtualenv? That would try to place files into a space where you need to be root. If you make a virtualenv you won't get those errors but this is only a temporary fix.

The LIB_PATH is supposed to be the upper level of the repo, i.e. the top level of what you clone. This path should be qark/lib and for reference the decompilation script is at qark/qark/decompiler/decompiler.py.

We have to rethink how we store our files since we can't use relative paths around 'site-packages'

nwalsh1995 commented 6 years ago

We don't want to:

  1. Download the decompilers more than once
  2. Drop files around site-packages
  3. Break cross-platform runs

From these three I think the users home directory .qark/decompilers is fine as long as we make sure it works on Windows as well.

A perfect solution to this is to have a configuration file that can contain the path to where the user wants the decompilers run. Then, qark will read the config file before running to set up.

nwalsh1995 commented 6 years ago

A few things that I think would be the best for us. It is not a good practice to install using sudo pip install . and people should instead do pip install . --user (or use a venv) for whatever packages they need to install. This would give us permission into their path as we would be running as the user. I will update the documentation to reflect this for the installation steps.

nwalsh1995 commented 6 years ago

Can you retry using the --user flag for pip and see that everything works ok?

nwalsh-lnk commented 5 years ago

Since the docs mention to install with the --user flag, I believe we will leave this. Closing out.