Proposal: Store downloaded files in a custom file format

[legoktm]

Proposal:

Affected components

• SecureDrop Workstation
• SecureDrop Client

People and roles

• @legoktm (proposer)
• SD team

Problem Statement

We have a few different problems that have been addressed in different ways, this is a proposal to address them in a single, more robust manner:

• Downloaded files should only be able to be opened in a sandboxed dispVM, and not in sd-app (solved by mime overrides)
• Nothing should process downloaded files, e.g. tracker-miner/tumblerd should not try to make thumbnails of images (Disable thumbnail previews in file managers in SecureDrop Workstation VMs #13)
• We should be able to specify which mime types open in which applications, but also gracefully handle when a file can't be opened (see Gracefully fail when sd-viewer does not support a file format securedrop-client#2007 (comment))

Solution impact

• We feel more confident about files being opened in the correct VM
• We simplify the maintenance of the various MIME file lists

Requirements and constraints

TK

Exploration

• previous do-not-open-here implementation, need to research more why it was abandoned

Initial proposal

We store files in a custom format, for example, b"SECUREDROP-UNSAFE" + base64(file.as_bytes()). This prevents any other processes from trying to mime sniff the file because it is base64-encoded, and if something tries to forcibly open it, it's just plain text.

We only need to teach mime/mailcap/XDG about our new file type (e.g. application/securedrop-unsafe) instead of overriding every single file type.

A companion wrapper program, securedrop-open, checks what VM it is being executed in, and if it's the wrong one, refuses to open (displaying an error, logging somewhere, etc.). If it's the correct VM, it "extracts" the underlying file and forwards it to xdg-open or whatever program we choose. It can also handle the case where no appropriate program is available.

To some extent, this is the new type pattern applied to a file.

Selected proposal