3 ms·

This but unironically. There's no way to ensure that nobody overwrote your .profile or .bashrc with a backdoored sudo that steals your password, or runs your co

by gruez 5mo ago

This but unironically. There's no way to ensure that nobody overwrote your .profile or .bashrc with a backdoored sudo that steals your password, or runs your command and then runs an evil command afterwards.

zahlman 5mo ago
`which sudo`? `/usr/bin/sudo`?
- bestham 5mo ago
  If they can override sudo, they can override which.
  - antonkochubey 5mo ago
    if you use \which it'll always be a shell built-in ;) though someone can put a different shell in your .zshrc
    - deleted 5mo ago
      [deleted]
    - jolmg 5mo ago
      $ which() { echo foo; } $ \which foo The backslash only prevents alias expansion.
      - pepa65 5mo ago
        He meant `command which`
        jolmg 5mo ago
        > it'll always be a shell built-in `command which` wouldn't have been the built-in
    - bandie91 5mo ago
      `exec /tmp/fake-bash` in bashrc to intercept everything?
  - zbentley 5mo ago
    Then use the absolute path.