Is Steam for Mac effectively running as superuser?

Question

When you download the client it does not weigh too much, and seems to do very little. Inside the app bundle there is a script that—upon inspecting the environment and deciding you're not running Linux—launches the client, which downloads the full support environment and resources. For this to happen (all of this is saved inside the bundle, the app bundle gets updated in this process) Steam wants Universal Access for Assistive Devices, and your password.

Cacheable resources, preferences (like keyboard shortcuts), support files (like game hardware requirement lookup tables) live inside the bundle, not in ~/Library/{Application Support|Preferences|Cache}; games' data get dumped into ~/Documents/Steam Content.

I'd describe myself as a bit OCD (which really says a lot), and I wouldn't care that much still. I'd go comb this hairy mess and find out where stuff is, when and if I need to, even if it's in an unfamiliar place; that does not actually tick me off. Well, a little bit.

What makes me concerned is the way Steam needs both Access for Assistive Devices, and my password to run for the first time. The former gives it the ability to talk very intimately with running apps and the underlying system; while the latter (admin account) could very well give it and it's publishers unrestricted access to all my software, hardware and data. With publishers like Rockstar using scene NOCD cracks to publish their games on Steam, I'm not so sure I'm OK with this.

I'd like more games made available for the MacOS X and all the pretty machines that run it, but this arrangement does not seem very Mac-like to me. It looks like Valve is going around system security measures and best practices, foregoing sandboxing, code signing, relatively sane structured organization; all the things that would appeal to someone who's no fun at parties at all, and will die alone, in his long dead mother's basement… wait. Right. Anyway.

Can we get some input on Steam for Mac security at the end-user machine, from someone who understands how Accessibility API works, whether games distributed on Steam can read and write outside the user homefolder, collect data from other running apps, or similar?

Answer 1

Answer from the devs themselves (Robert Barris, in this case):

Activating Universal Access is not a requirement for Steam or for games on Steam. However if you want to use the Steam Overlay then it is needed - UA provides the mechanism by which the Overlay can intercept keys from the game even when the game is front most.

No, Steam games are not running as superuser :/

Answer 2

There are thousands of installers that need your admin password to write to protected areas of the filesystem, including Apple's. If you want to know what user a process is running as then use ps or Activity Monitor.

Enabling assistive device access is a common workaround used when a non-scriptable application needs to be automated through a series of simulated clicks on windows and menus. It is far more likely that the people working on this product simply know nothing about the Mac platform than it is that they're interested in telling your mom where your naughty folders are.

http://www.macosxautomation.com/applescript/uiscripting/index.html

Answer 3

Steam is not running as root. It simply needs your credentials to install.The fact that is uses Assistive Devices isn't a big deal. Many apps do.In fact, most games do.

I have steam running and I'm not worried about this.

But if you are, then get something like Little Snitch. It monitors ALL in and out going traffic from your mac. It's a must app for every mac user. Some use it to replace the firewall. And you tell it what apps/processes too allow access to the net. That way, if Steam runs a process that you aren't familiar with you will be notified. And you can decide to grant (or not) access.

You should be running Little Snitch anyway. But frankly, I think you are worried too much about Steam.

Answer 4

My partner installed Steam on one of our Macs, and her own account isn't in the 'admin' group - /var/log/secure.log shows she only had to use an admin account for Finder to copy it to "Applications".

Access for Assistive Devices was already enabled on that Mac. A process listing confirms that nothing running for Steam is running as root (but it is running as your user. It can do anything you can, just like almost any other bit of software on a standard Unix, including reading or erasing all your files.)

If you're very paranoid, install and run your games in a separate user account.