4 ms·
No, but I do trust some software enough to run as non-root. Sadly to install this non-root software I need to install the RPM as root, and then I have no idea w
by tokenizerrr 11y ago
No, but I do trust some software enough to run as non-root. Sadly to install this non-root software I need to install the RPM as root, and then I have no idea what it's going to do during the pre- and post- hook scripts.
- icebraining 11y agoI don't know about RPM, but for deb you can just do "dpkg-deb --control <deb file>" to see those scripts.
- brazzledazzle 11y agoYou can export the scripts from an rpm without installing it.
- IgorPartola 11y agoI suppose. Though have you considered the fact that if someone has non-root local access to your machine, they are just one local privilege escalation away form becoming root? And these things come out fairly frequently that you can pretty much count on one being found soon. In other words IMO you should either trust or not trust a piece of code to run on your machine. The distinction between root and non-root user running the code is more for maintainability and sanity and less for actual security.