On Tue, Jun 12, 2018 at 07:50:29AM -0400, Nico Kadel-Garcia wrote: > On Tue, Jun 12, 2018 at 7:10 AM, Tomasz Kłoczko > <kloczko.tomasz@xxxxxxxxx> wrote: > > > Just FTR: So far I was unable to find in any of the fredesktop.org or > > other specs (https://www.freedesktop.org/wiki/Software/) things like > > requirement use /usr/local{bi,sbin} or ~.local/bin in $PATH (and > > especially on the front of thes env variable). I would be really glad > > to find original reason why paths like /usr/local{bi,sbin} have been > > added to OOTB $PATH and why someone has been thinking that those paths > > should be added on the front of the $PATH. > > Most of them aren't worried enough about it, or don't have enough > history to see underlying problems. Most think, and I'm pretty sure of > this, that you've gotten the security explanations done repeatedly and > seem to have ignored them. They're certainly not actually spelled out > in your analysis. > > The simple fact is that "sudo" inherits $HOME and $PATH by default. > Your proposed change would make privilege escalation attacks against > sudo users much more trivial by opening up the attack surface for > every binary in /bin or /usr/bin to be replaced by a local binary in > ~/.local/bin/. No, it doesn't increase the risk. If someone has privs to create binaries in $HOME/.local/bin, then they can already change $HOME and $PATH env vars. If this attack scenario is a concern, then change sudo to not honour env variables like $HOME/$PATH at all. Regards, Daniel -- |: https://berrange.com -o- https://www.flickr.com/photos/dberrange :| |: https://libvirt.org -o- https://fstop138.berrange.com :| |: https://entangle-photo.org -o- https://www.instagram.com/dberrange :| _______________________________________________ devel mailing list -- devel@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to devel-leave@xxxxxxxxxxxxxxxxxxxxxxx Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/devel@xxxxxxxxxxxxxxxxxxxxxxx/message/QHL7XRN77UYAXOY5DT4SZ4T7YXT6EDPE/
