5 ms·

Once you own the home folder you can drop aliases for anything you want in the bashrc with almost no one noticing. At that moment point you are essentially done

Once you own the home folder you can drop aliases for anything you want in the bashrc with almost no one noticing. At that moment point you are essentially done in almost all cases even in the absence of a local root exploit which Linux continues to be rife with. You will eventually catch a sudo password (using a trivial sudo wrapper alias) and all the ssh keys and jump host or password manager config.

medstrom 3y ago
Moreover, even if the user manages to deny you root access through excellent hygiene, that just means you can't include this machine in your botnet. You still have full view of the home folder! Upload to a data broker, get $.
Jenda_ 3y ago
Of course - the point is not to get the home folder owned. There is no reason why Evince/Okular or mpv (to name a few apps which handle files with complex formats from untrusted sources) should have the right to access anything beside their ~/.config/<application_name> and the file they are currently viewing/playing, or maybe read-only ~/Music. If you want to do a "Save as", you will do this through a OS-controlled file dialog, or save it to /tmp and copy it. This can be achieved with AppArmor, with a caveat that in X, applications can steal each other's windows, but unfortunately this is not the default and easy configuration on most distros.
dpkirchner 3y ago
I guess it would make sense to make bashrc, zshrc, whatever immutable to all but root. Never really considered that before. Allowing them to be edited is like allowing you to install or edit binaries anywhere in your $PATH.
- Jenda_ 3y ago
  There are many more files that will need this protection: - autorun and keyboard shortcuts of your window manager -- one can hook an evil command to Ctrl+C - ~/.mozilla -- you can add arbitrary javascript to your profile or extensions - any application which does not expect to have its config externally tampered with and this may result in various errors including RCE - ~/work/FooProject/Makefile, configuration of your IDE (which contains list of commands that shall be executed to compile) etc. An explicit allowlist would be a better option, IMHO perfectly manageable - with a popup window "the app wants to access <file>, allow once | allow permanently | deny".

medstrom 3y ago

Moreover, even if the user manages to deny you root access through excellent hygiene, that just means you can't include this machine in your botnet. You still have full view of the home folder! Upload to a data broker, get $.

Jenda_ 3y ago

Of course - the point is not to get the home folder owned. There is no reason why Evince/Okular or mpv (to name a few apps which handle files with complex formats from untrusted sources) should have the right to access anything beside their ~/.config/<application_name> and the file they are currently viewing/playing, or maybe read-only ~/Music. If you want to do a "Save as", you will do this through a OS-controlled file dialog, or save it to /tmp and copy it. This can be achieved with AppArmor, with a caveat that in X, applications can steal each other's windows, but unfortunately this is not the default and easy configuration on most distros.

dpkirchner 3y ago

I guess it would make sense to make bashrc, zshrc, whatever immutable to all but root. Never really considered that before. Allowing them to be edited is like allowing you to install or edit binaries anywhere in your $PATH.

Jenda_ 3y ago
There are many more files that will need this protection: - autorun and keyboard shortcuts of your window manager -- one can hook an evil command to Ctrl+C - ~/.mozilla -- you can add arbitrary javascript to your profile or extensions - any application which does not expect to have its config externally tampered with and this may result in various errors including RCE - ~/work/FooProject/Makefile, configuration of your IDE (which contains list of commands that shall be executed to compile) etc. An explicit allowlist would be a better option, IMHO perfectly manageable - with a popup window "the app wants to access <file>, allow once | allow permanently | deny".