Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #244722

Re: Security

Show all headers | View raw

On 2022-01-27 21:44:07 -0600, Nicholas Geovanis wrote:
> On Wed, Jan 26, 2022, 12:39 PM Andrei POPESCU <andreimpopescu@gmail.com>
> wrote:
> 
> > I'll use the opportunity to draw attention to DSA-5059-1, see e.g. this
> > article for details:
> >
> >
> > https://arstechnica.com/information-technology/2022/01/a-bug-lurking-for-12-years-gives-attackers-root-on-every-major-linux-distro/
> >
> > And please don't bother to reply with "there are no other users on this
> > system I should worry about", the bad guys could still find ways to get
> > in, e.g. via a compromised browser, regardless if you are behind a
> > firewall or not[1].

Running the browser in firejail should be sufficient as the profile
should disable pkexec, e.g.

$ firejail --profile=firefox ls   
Reading profile /etc/firejail/firefox.profile
[...]
Error: execute permission denied for /usr/bin/pkexec
Error: no suitable pkexec executable found

> Servers don't have browsers installed on them, for exactly this reason.

Servers shouldn't have pkexec installed in the first place, anyway.

-- 
Vincent Lefèvre <vincent@vinc17.net> - Web: <https://www.vinc17.net/>
100% accessible validated (X)HTML - Blog: <https://www.vinc17.net/blog/>
Work: CR INRIA - computer arithmetic / AriC project (LIP, ENS-Lyon)

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Security Polyna-Maude Racicot-Summerside <debian@polynamaude.com> - 2022-01-25 21:10 +0100
  Re: Security Andy Smith <andy@strugglers.net> - 2022-01-25 21:50 +0100
    Re: Security Polyna-Maude Racicot-Summerside <debian@polynamaude.com> - 2022-01-25 22:00 +0100
      Re: Security Nicholas Geovanis <nickgeovanis@gmail.com> - 2022-01-26 16:40 +0100
  Re: Security Nate Bargmann <n0nb@n0nb.us> - 2022-01-25 23:20 +0100
    Re: Security Andrei POPESCU <andreimpopescu@gmail.com> - 2022-01-26 19:40 +0100
      Re: Security Nicholas Geovanis <nickgeovanis@gmail.com> - 2022-01-28 04:50 +0100
        Re: Security Dan Ritter <dsr@randomstring.org> - 2022-01-28 14:20 +0100
          Re: Security Nicholas Geovanis <nickgeovanis@gmail.com> - 2022-01-28 17:20 +0100
            Re: Security Dan Ritter <dsr@randomstring.org> - 2022-01-28 19:00 +0100
        Re: Security Vincent Lefevre <vincent@vinc17.net> - 2022-01-28 16:20 +0100
          Re: Security Nicholas Geovanis <nickgeovanis@gmail.com> - 2022-01-28 17:30 +0100
          Re: Security Richard Hector <richard@walnut.gen.nz> - 2022-01-30 13:40 +0100
            Re: Security Reco <recoverym4n@enotuniq.net> - 2022-01-30 14:20 +0100
              Re: Security Andrei POPESCU <andreimpopescu@gmail.com> - 2022-01-30 14:40 +0100
                Re: Security Reco <recoverym4n@enotuniq.net> - 2022-01-30 17:50 +0100
                Re: Security Andrei POPESCU <andreimpopescu@gmail.com> - 2022-02-04 09:50 +0100
                Re: Security Reco <recoverym4n@enotuniq.net> - 2022-02-04 10:20 +0100
                Re: Security <tomas@tuxteam.de> - 2022-02-04 10:20 +0100
            Re: Security Vincent Lefevre <vincent@vinc17.net> - 2022-02-01 12:30 +0100
              Re: Security Richard Hector <richard@walnut.gen.nz> - 2022-02-02 02:00 +0100
                Re: Security Vincent Lefevre <vincent@vinc17.net> - 2022-02-02 15:10 +0100
        Re: Security Andrei POPESCU <andreimpopescu@gmail.com> - 2022-01-28 17:30 +0100

csiph-web