Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #182372

Re: where to submit low security vulnerability in .profile?

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

On 2017-06-19 at 11:59, Henrique de Moraes Holschuh wrote:

> On Mon, 19 Jun 2017, Greg Wooledge wrote:
> 
>> You appear to be claiming that putting ~/bin in PATH is somehow
>> inherently unsafe.  I don't agree.  Under what conditions would
>> this result in any kind of privilege escalation?
> 
> The OP was complaining that ~/bin was being *prepended* to PATH,
> instead of appended.
> 
> When you prepend ~/bin to PATH, it allows one to have a shell script
> such as ~/bin/sudo that will be run instead of the system's sudo.
> Then, some use of social engineering might get an admin or some other
> user to type in a password to run a command using su or sudo.
> 
> That said, no, it is not usually considered a security
> vulnerability, because NOT using the full path to run commands such
> as "su" and "sudo" in the first place IS considered gross
> negligence.
> 
> So, train your fingers!  There is no "su", it *is* /bin/su.  And
> there is no "sudo", it *is* /usr/bin/sudo.  Never trust aliases,
> PATH, or anything of the like for this stuff.

Wouldn't that seem to be an argument against installing the real su,
sudo, and so forth, _anywhere_ in $PATH? If running them in any other
way than with the full explicit path is such bad security practice, then
why do we install them in such a way as to facilitate doing so?

-- 
   The Wanderer

The reasonable man adapts himself to the world; the unreasonable one
persists in trying to adapt the world to himself. Therefore all
progress depends on the unreasonable man.         -- George Bernard Shaw

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

where to submit low security vulnerability in .profile? David Bunch <depb@posteo.net> - 2017-06-18 07:20 +0200
  Re: where to submit low security vulnerability in .profile? Nicolas George <george@nsup.org> - 2017-06-18 11:10 +0200
    Re: where to submit low security vulnerability in .profile? RavenLX <ravenlx@sitesplace.net> - 2017-06-18 14:00 +0200
  Re: where to submit low security vulnerability in .profile? RavenLX <ravenlx@sitesplace.net> - 2017-06-18 14:00 +0200
    Re: where to submit low security vulnerability in .profile? David Wright <deblis@lionunicorn.co.uk> - 2017-06-18 19:10 +0200
  Re: where to submit low security vulnerability in .profile? Greg Wooledge <wooledg@eeg.ccf.org> - 2017-06-19 14:40 +0200
    Re: where to submit low security vulnerability in .profile? Henrique de Moraes Holschuh <hmh@debian.org> - 2017-06-19 18:00 +0200
      Re: where to submit low security vulnerability in .profile? Greg Wooledge <wooledg@eeg.ccf.org> - 2017-06-19 18:10 +0200
        Re: where to submit low security vulnerability in .profile? Nicolas George <george@nsup.org> - 2017-06-19 19:20 +0200
        Re: where to submit low security vulnerability in .profile? Ansgar Burchardt <"Ansgar Burchardt"@43-1.org> - 2017-06-20 01:40 +0200
      Re: where to submit low security vulnerability in .profile? Nicolas George <george@nsup.org> - 2017-06-19 18:10 +0200
      Re: where to submit low security vulnerability in .profile? The Wanderer <wanderer@fastmail.fm> - 2017-06-19 18:40 +0200
        Re: where to submit low security vulnerability in .profile? Henrique de Moraes Holschuh <hmh@debian.org> - 2017-06-19 20:30 +0200

csiph-web