New answers tagged

1

The recipe here, while not by any means foolproof, is incomplete or wrong. Installing untrusted software under your unprivileged account is a disaster. Installing it in a carefully prepared other unprivileged account? Less risky, but by no means guaranteed to be safe. If: you are sure that your system is set up as a secure multi-user system (no random ...


-2

Considering everything in Linux is open source bypassing accounts would be easy for a hacker. You could even decrypt an encrypted drive if know what you are doing.


8

This is a horrible case of Security Theater Security Theater is the practice or belief of something that looks like it improves security, but in reality does little/harm to it. This false belief has been around as long as the following rumor Linux has no viruses because of it's permission system That's almost as good as saying I don't have a ...


4

The system itself is safe from accounts that aren't root-equivalent, but that doesn't help much on a desktop where most of what you care about is your own data, and you authenticate regularly to become root from your account. If someone has an account on a correctly-configured multi-user system, and they don't have sudo privileges or the root password, then ...


26

In short: yes, being on a low-privilege account helps protect you against malware, but does not make you immune. Like any security measure, no single thing is going to keep you 100% safe. TL;DR: Running on a low-privilege account (aka "principle of least privilege") should be part of a balanced breakfast which also includes good firewall configurations; ...


-3

isn't it possible for a low-level user to install a script with a keylogger, for example, that waits for an su - or sudo call and takes system control from there? No - and you've already given the answer, because that is "out of their permission scope". Linux has always been a multi-user system and (nearly) everything which can be implemented outside of ...


49

We always hear... Do we? I don't. Installing some untrusted program as a normal user is a bad idea with Linux the same it is with Windows or Mac: this program has access to all your data and can delete these data, send these data to somebody else etc. Moreover it can make screenshots, control other applications running on the same X windows screen ...


1

It depends on the application, but generally it is "yet another factor that must be taken into consideration". In addition to checking the content and type of uploaded files, saving uploaded files outside of web server's executable directories and a multitude of other necessary precautions. For detailed information refer for example to the OWASP article on ...


0

I guess it all depends who owns the file/who runs the upload file... if is a malicious file and root runs it.. then no matter what permissions you have you are screwed :) but I will use 750 if I was you. Also you can try to chroot your app, and that directory.


2

The issue is that the attacker can create a symlink before a vulnerable program can. For example, you could write a script that watches the process list, and as soon as a program with the right name shows up in the list, the script would race to create a symlink to a privileged file before the vulnerable program can. If the vulnerable program is running as ...



Top 50 recent answers are included