4 ms·
This sounds like a prime new vector for malware, ironically.
by drdexebtjl 4mo ago
This sounds like a prime new vector for malware, ironically.
- scott_w 4mo agoMy understanding is probably not: the hooks are configured locally, not by other packages automatically, so you’d install and setup the pre-install hooks yourself to check the packages before install/update. Can it be exploited? Yes, anything can. But that’s not a reason to not do this if the overall result is better.
- self_awareness 4mo agoAnd how a malware can use this if it's configured globally in a root:root owned config file?
- drdexebtjl 4mo agoNot all package managers require root. But yeah, maybe through an exploit with a narrow reach. Once in, the malware can veto security updates and escalate to full control.
- self_awareness 4mo agoWith root, malware can reach out to UEFI anyway, and can do whatever it likes.
- drdexebtjl 4mo agoWriting text to a specific root-owned config file != being root. If you have the former, you need something like this to escalate. I’d prefer if my package manager had no ability to run arbitrary payloads at all.