3 ms·
> I was actually with them until > "In fact, the Kitten installer does just this." 100% agree > Even if there's a confirmation There isn't, if your sudo is
by philsnow 4y ago
> I was actually with them until
> "In fact, the Kitten installer does just this."
100% agree
> Even if there's a confirmation
There isn't, if your sudo is set up to cache credentials and you have sudo'ed something recently enough [0]:
# Reduce unprivileged ports for this session...
sudo sysctl -w net.ipv4.ip_unprivileged_port_start=80 2>&1 1>/dev/null
It could be polite to `sudo -k` before that, so people who use NOPASSWD sudo (and I guess don't care as much about security on that machine) don't have the speedbump whereas people who would otherwise have to type their password indeed end up typing their password.. but still, this is too much for an installer.
Just print something to stdout, make it red if you want, and include a note in the documentation to the same effect.
While I was looking, I saw this a few lines down:
sudo chmod 0777 "${sysctlConfigurationFilePath}"
sysctl.conf(5) on my system doesn't say anything about what mode bits files in /etc/sysctl.d need to have, but +x is not often used for configuration files. I haven't looked further, but this is a smell.
[0] https://codeberg.org/kitten/app/src/commit/7ca1f8a4d191f3a81d4a450fb8a04d41457745d4/install#L171-L172 https://codeberg.org/kitten/app/src/commit/7ca1f8a4d191f3a81...
[1] https://codeberg.org/kitten/app/src/commit/7ca1f8a4d191f3a81d4a450fb8a04d41457745d4/install#L175-L177 https://codeberg.org/kitten/app/src/commit/7ca1f8a4d191f3a81...
- rcxdude 4y ago+x isn't as concerning as world-writable. This basically allows any user to escalate to root privileges through exploiting sysctl parameters like kernel.modprobe (albeit after a reboot).
- seba_dos1 4y ago...and that's coming from someone who has audacity to comment on and criticize well-established security practices because they find them inconvenient. Wow. For the record, this isn't just "a smell". This is effectively a (likely unintended) backdoor for any user to gain root privileges. Any kind of user-based separation becomes moot at that point.