4 ms·
You are downloading software from the internet. How it executes code on your machine is irrelevant, you already trust it. Or do you review every OS package you
by IgorPartola 11y ago
You are downloading software from the internet. How it executes code on your machine is irrelevant, you already trust it. Or do you review every OS package you install for shenanigans on every update? This is an especially bad point to bring up in the context Sandstorm, which runs stuff as root all the time. Do you mean to say that you trust them enough to run a bunch of stuff as root on your server, but not to run a post-install script?
- tokenizerrr 11y agoNo, but I do trust some software enough to run as non-root. Sadly to install this non-root software I need to install the RPM as root, and then I have no idea what it's going to do during the pre- and post- hook scripts.
- icebraining 11y agoI don't know about RPM, but for deb you can just do "dpkg-deb --control <deb file>" to see those scripts.
- brazzledazzle 11y agoYou can export the scripts from an rpm without installing it.
- IgorPartola 11y agoI suppose. Though have you considered the fact that if someone has non-root local access to your machine, they are just one local privilege escalation away form becoming root? And these things come out fairly frequently that you can pretty much count on one being found soon. In other words IMO you should either trust or not trust a piece of code to run on your machine. The distinction between root and non-root user running the code is more for maintainability and sanity and less for actual security.