Re: games running sgid

[Callum McKenzie <callum spooky-possum org>]

This is actually a summary of what I sent Daniel earlier this evening -
I never seem to select the right reply button in evolution.

setgid is there to solve a single problem: cheating. Aside from the
obvious advantage of making sure people can't randomly rewrite the high
scores file it also stops people connecting gdb to the running program
and altering the score before it gets written to file. This is all well
and good, but there are several major problems: 1) No debugging
information is generated. This makes diagnosing crashes and fixing bugs
very hard when you can't reproduce the crash yourself. 2) We have to
drop privileges before initialising gnome (because GTK complains). 3) It
is very prone to installation hiccups.

Point 1 is the one that affects me the most, but it isn't a
justification for dropping setgid since the benefit is entirely on my
side and not the users. The second and third points have more of an
effect on users and as a result the new high scores code was written
with the assumption that setgid was not going to be supported in the old
way. Unfortunately the code has ended up in limbo with the default
installation not working properly if you are installing almost anything
but a local copy (i.e. no privileges).

I have been in a state of paralysis/procrastination, not being sure what
to do next. Recent prodding has convinced me that something needs to be
done soon - i.e. the next few days. The current plan is to write a
helper-app which will either be setgid itself (with no setgid for the
games) or forked off by the program at launch (pretty much what happens
now).

Preliminary work suggests the later will be the better option.

I should note that I am almost convinced that the score files should be
world-writable and the whole idea that high scores should be protected
done away with (if your little brother keeps erasing your gnometris high
score then the best way to deal with it doesn't involve a computer).
However I can foresee a number of situations where this isn't a good
idea, so I'm not going to do that yet. However, a straight-forward - but
not trivial - way to cheat shouldn't be seen as a big problem in my view
(non-setgid programs will always be prone in this way).

(I am very open to argument about this last paragraph.)

 - Callum