search

madaidans-insecurities / madaidans-insecurities.github.io

https://madaidans-insecurities.github.io/
136 stars 28 forks source link

Mention Pipewire in Linux hardening guide #36

Closed FieryBinary closed 2 years ago

FieryBinary commented 2 years ago

You already mentioned how PulseAudio is insecure, and to use standard ALSA utilities instead. However, that might not be feasible for many users.

What do you think of Pipewire? It's written with security in mind, and it works well out-of-the-box. It's still early in development.

Website: https://pipewire.org/

Akkowicz commented 2 years ago

https://www.freedesktop.org/wiki/Software/PulseAudio/Documentation/Developer/AccessControl/

Pulseaudio was not written with security in mind, it runs almost unrestricted in user-context and any app can snoop on another application's audio.

madaidans-insecurities commented 2 years ago

Thanks; added by https://github.com/madaidans-insecurities/madaidans-insecurities.github.io/commit/29fa22faf03d4af90b218fe4e3b2d536a6ced566.

madaidans-insecurities commented 2 years ago

https://madaidans-insecurities.github.io/guides/linux-hardening.html#pulseaudio

PulseAudio is a common sound server, but it was not written with isolation or sandboxing in mind, making it a recurring sandbox escape vulnerability. To prevent this, it is recommended to block access to PulseAudio from within your sandbox or uninstall it from your system entirely. You can use the standard ALSA utilities or PipeWire instead.