4 ms·

And how a malware can use this if it's configured globally in a root:root owned config file?

• drdexebtjl 4mo ago
  Not all package managers require root. But yeah, maybe through an exploit with a narrow reach. Once in, the malware can veto security updates and escalate to full control.
  • self_awareness 4mo ago
    With root, malware can reach out to UEFI anyway, and can do whatever it likes.
    • drdexebtjl 4mo ago
      Writing text to a specific root-owned config file != being root. If you have the former, you need something like this to escalate. I’d prefer if my package manager had no ability to run arbitrary payloads at all.