Claim that Skype is an unconfined application able to access all one's own personal files and system resources

Question

Situation

I was about to install Skype on a laptop driven by Ubuntu 18.04 LTS Desktop. The software installation helper graciously informs me that Skype

is unconfined. It can access all your personal files and system resources

as per the screenshot below.

Apparently there must be reasons to make a distinction from applications that do not call for this warning.

Reality-checks

• Can Skype really scan anything I have in my home directory regardless of the permissions set to files and directories? Does it become like a sort of superuser?
• What is the meaning of system resources there? Does it go about functional resources like broadband and memory, or is that an understatement for control on all applications?

Mitigation

• How is it possible for an average "power user" to confine such an unconfined application?

Beside the mere answering, pointing out to interesting readings is also appreciated.

Answer 1

Why am I getting this message?

The idea of snap is to be an "app store for Linux", with much of the same benefits as app stores for other platforms, such as iOS or Android. One of the big advantages is that applications are rather confined, unable to interact with your OS unless the user gives it specific permissions.

In snap, there are several different "confinement" settings, as documented here:

• Strict

  Used by the majority of snaps. Strictly confined snaps run in complete isolation, up to a minimal access level that’s deemed always safe. Consequently, strictly confined snaps can not access your files, network, processes or any other system resource without requesting specific access via an interface (see below).

• Classic

  Allows access to your system’s resources in much the same way traditional packages do. To safeguard against abuse, publishing a classic snap requires manual approval, and installation requires the --classic command line argument.

• Devmode

  A special mode for snap creators and developers. A devmode snap runs as a strictly confined snap with full access to system resources, and produces debug output to identify unspecified interfaces. Installation requires the --devmode command line argument. Devmode snaps cannot be released to the stable channel, do not appear in search results, and do not automatically refresh.

The Skype app is most likely a "Classic" snap, which means you don't get the same benefits as from a strict confinement.

Can Skype really do anything on my system?

Skype can do as much as any other traditional binary can do, such as those installed via apt. It does not generally become "some kind of super user", but it could use sudo or other means to ask to become a privileged process. The easiest way to do that is to simply refuse running as anything but root.

However, Skype cannot magically bypass any file permissions, unless you specifically gave the binary capabilities to do so.

What does it mean by system resources?

Think about apps on your smartphone. Applications have to ask to access your files, your contacts, your microphone, your camera, your location, etc.

Snap in its strict confinement setting does allow applications to access these, but individual applications need to request access to these interfaces. Of course, you as the user can forbid an application from accessing them. Perhaps you don't want an application to access the network because you don't want to use network-enabled features.

What the installer is telling you is that, since Skype is a "classic" snap, you cannot stop Skype from accessing all these resources (network, camera, etc.), at least not in an easy way.

How is it possible to confine such an application?

You can, if you so desire, try to create a strictly confined snap yourself. I assume that this will be a difficult-if-not-impossible task, else Microsoft had done that. Or maybe it's super easy, barely an inconvenience, and Microsoft just didn't care.

You could also create a limited user and configure your system to run the application as this user, then restrict that limited user from accessing resources such as the network, the web cam, etc.

Answer 2

It’s like this comic:

Generally, any program that runs under your account can access any resources that your account can access.

Can Skype really scan anything I have in my home directory regardless of the permissions set to files and directories?  Does it become like a sort of superuser?

As stated in MechMK1’s answer, no, it does not become more privileged than you.  But, even if you chmod a file to 0, as long as you still own the file, any program (running under your user ID) can chmod it back to a more permissive access mode.

In general, it can do anything that malware can do if it runs on your system as you.  For example, it can

• modify your .bashrc, .bash_profile, or similar file to start it (or a component of it) every time you login.
• monitor your keystrokes (subject to constraints that are beyond the scope of this question).
• maybe read your screen (?)

How is it possible for an average "power user" to confine such an unconfined application?

If you’re paranoid that Skype (or any other program) is malware, but you want to run it anyway, there are some things you can do to protect yourself (and your data).  In (roughly) decreasing order of security:

• As suggested by Benjamin, isolate the untrusted software in some sort of jail, sandbox, container or virtual machine.
  • Depending on how paranoid you are, you could have one isolation area for all untrusted software, or one for each untrusted program.
• As suggested by MechMK1, create another user (with a different UID) for the untrusted software, and always run the software as that user (with sudo or su, or by logging in as the other user in another virtual terminal).
  • Again, you could create one such user for all untrusted software, or one user for each untrusted program.
• Create a separate user account for your most sensitive data.
  This is pretty much the same as the above bullet, but looking at it from the opposite direction.
• Encrypt your most sensitive data.  This is the least secure of these options, as
  • it does not prevent the software from deleting or overwriting your files, and
  • as long as untrusted software is running as you, it can probably monitor a lot of your actions, and possibly read your data when you decrypt it to work with it.

None of the above is guaranteed.

---

Getting back to this:

Does it become like a sort of superuser?

For completeness, a program (that can run unconfined) can become privileged in the usual ways:

• It can invoke sudo or su and hope you type the password.  (Advice: Don’t do that!)
• It can invoke sudo or su and try to guess the password.
• It can invoke sudo and hope that you used sudo within the past five minutes, so your credentials are still cached (see the Sudoers Manual).
• It can exploit a privilege-escalation vulnerability in the operating system.

etc.  The confinement procedures discussed above can mitigate some of these attacks.