What gets installed

DataSabi is two packages. This page lists everything each one adds to your system, what the background service is allowed to do, and the commands to check it yourself before and after installing.

The service (open source)

Package: datasabi-collector. This is the only part that runs with elevated rights. Its code, including the install scripts, is public under Apache-2.0: github.com/arkodeontech/datasabi-collector.

Files in the package:

• /usr/lib/datasabi/datasabi-collector: the service
• /usr/bin/dsctl: a command-line tool for reading your usage (dsctl)
• /usr/lib/systemd/system/datasabi-collector.service: the systemd unit that starts the service and sets its rights
• /usr/share/doc/datasabi-collector/: the README and licence

What the install script changes:

• Creates a system group and a system user, both called datasabi. The user can't log in (no login shell); its home is set to the data folder, /var/lib/datasabi.
• Adds you (the person who ran sudo apt install or sudo dnf install) to the datasabi group. That's why you log out and back in once.
• Enables and starts the service.

Created when the service runs:

• /var/lib/datasabi/usage.db: your usage history. The folder is readable only by the datasabi user and group.
• /run/datasabi/collector.sock: the socket the app talks to. Only members of the datasabi group can connect. It's removed at shutdown.

The app

Package: data-sabi (DataSabi on Fedora). The desktop app is free but not open source. It runs as you, with no special rights, and its package has no install scripts.

Files in the package:

• /usr/bin/datasabi: the app
• /usr/share/applications/DataSabi.desktop: its entry in your app menu
• /usr/share/icons/hicolor/*/apps/datasabi.png: its icon

It also depends on your system's standard libraries for the window, tray icon and notifications (WebKitGTK, GTK 3, AppIndicator, libnotify).

Created in your home folder the first time the app runs:

• ~/.config/autostart/DataSabi.desktop: starts DataSabi when you log in. Turning off Start at login in Preferences removes it.
• ~/.config/com.arkodeon.datasabi/: background settings
• ~/.local/share/com.arkodeon.datasabi/: the window's own storage, such as your theme and units

What the service is allowed to do

systemd starts the service as the datasabi user, never as root, with exactly four Linux capabilities:

• CAP_NET_RAW and CAP_NET_ADMIN: open a packet capture on your network interfaces
• CAP_SYS_PTRACE: look inside /proc/<pid>/ for processes that belong to other users, to see which app owns each connection
• CAP_DAC_READ_SEARCH: read those /proc entries even though they belong to other users

To be plain about the last one: CAP_DAC_READ_SEARCH lets a program read any file on the system, not only /proc. The service uses it only to read /proc and the app menu (.desktop) files in home folders, to name apps. You can check this in the source. Reducing what it can reach is planned for the next service release.

The unit also limits the service with these systemd settings:

• NoNewPrivileges=yes: it can never gain more rights than the four above
• ProtectSystem=strict and ProtectHome=read-only: it can't change system files or anything in home folders; it can write only to /var/lib/datasabi, /run/datasabi and its own temporary folder
• PrivateTmp=yes: it gets its own temporary folder
• ProtectKernelTunables, ProtectKernelModules, ProtectKernelLogs, ProtectControlGroups, ProtectClock, ProtectHostname: it can't change kernel settings, load kernel modules, read kernel logs, or change the clock or hostname
• RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_PACKET AF_INET AF_INET6: only the socket types it needs
• RestrictNamespaces, RestrictRealtime, RestrictSUIDSGID, LockPersonality, MemoryDenyWriteExecute, SystemCallArchitectures=native: standard hardening that blocks common ways to escalate

What it reads from each packet

The service captures at most the first 128 bytes of each packet, which is enough for the headers. It reads only the addresses, ports and sizes, and stores only byte counts per app, per network and per time period. Packet contents are never parsed, logged or saved, and neither are the addresses of the sites you connect to.

On most packets, 128 bytes is a little more than the headers, so the start of the content does reach the service's memory before it's discarded. The parser reads only fixed header positions: the IP addresses, the protocol and the two port numbers. To name your network and tell whether it's metered, the service asks NetworkManager (over D-Bus); it doesn't run any other programs. You can check all of this in packet.rs and capture.rs.

Check it yourself

Before installing, from your Downloads folder:

List the files in the package:

$ dpkg -c datasabi-collector_*_amd64.deb

Read the install scripts (they are short):

$ dpkg-deb -e datasabi-collector_*_amd64.deb ds-scripts
$ cat ds-scripts/postinst ds-scripts/prerm ds-scripts/postrm

Check the download against SHA256SUMS.txt from the download page:

$ sha256sum --check --ignore-missing SHA256SUMS.txt

From the next service release, you'll also be able to check that the package was built by GitHub from the public source (not available for 0.1.6):

$ gh attestation verify datasabi-collector_*_amd64.deb --repo arkodeontech/datasabi-collector

After installing:

See the exact unit systemd is running:

$ systemctl cat datasabi-collector

See the user and the capabilities the running service has:

$ systemctl show datasabi-collector -p User -p AmbientCapabilities -p NoNewPrivileges
$ getpcaps $(pidof datasabi-collector)

Next steps

• Try it safely: try only the open-source part first
• How DataSabi works
• Uninstalling

Issue with this page? Email isaac@arkodeon.com