0

I asked this question on Unix Stackexchange. How to access /root directory from a browser?

I got an answer (in a comment by @dsstorefile) that It can be accessed either way :

  1. By running chmod 0777 root
  2. By running browser as a Root User.

I think It's just a listing of the contents in the directory (for that I maybe wrong) but I want to know :

What could be Possible security risks/threats associated of accessing /root directory from the browser in each case ?

Improve this question
8
  • 3
    For the love of god, don't set /root to mode 0777!
    – forest
    Apr 29, 2018 at 10:26
  • I think you should explain why do you want to access /root in the browser in the first place. As asked currently the question looks for me more like "what is the risk of shooting myself in the foot" which is not worth answering.
    – Steffen Ullrich
    Apr 29, 2018 at 10:45
  • @SteffenUllrich In the link to Unix.SE he provided, he said it was for learning purposes.
    – forest
    Apr 29, 2018 at 10:46
  • @forest: this does not make it better in my opinion. Even when doing things for learning purposes one should ask why one would do this - i.e. why does somebody want to learn how to shoot himself in the foot?
    – Steffen Ullrich
    Apr 29, 2018 at 10:49
  • 1
    @PeterHarmann: I'm not saying that the question itself should never be asked but that it should contain enough context to indicate why it is asked. If somebody asks me out of the blue what happens if he shoots itself in the foot my first reaction would be find out why he is asking this and not to explain what happens - just to be sure that the OP is not currently playing around dangerously with a gun.
    – Steffen Ullrich
    Apr 29, 2018 at 11:09

1 Answer 1

Reset to default
6

The issues are that anyone on your system will be able to maliciously elevate themselves to root privileges. Doing either of these things is a very bad idea. To address your specific scenarios:

  1. Making root's home directory mode 0777 means that all users will be able to read, write, enter, and execute any files in that directory. Because many sensitive, privileged processes use that as their home, making it world-writable could allow any unprivileged process to tamper with root's home. For example, malicious code in /root/.profile would be executed with high privileges any time the root user logs in. There are many ways to exploit you in this scenario.

  2. Running your browser as root is also extremely dangerous. It means an exploited browser will run as root, rather than as your normal user. This is not a hypothetical threat. Someone actually did run their browser as root and got infected with ransomware! Additionally, a regular browser is not designed to run with a privileged context and so does not take the necessary security precautions to prevent an unprivileged local user from exploiting it. For example, if you run your browser in your regular user's environment, but as root, then a modified configuration file or browser extension (in your regular user's home) could exploit it to elevate to root.

You could make /root mode 0755, which would make it writable only by root, but would allow everyone else to enter and read it (including your browser). Normally, it does not contain any sensitive information, but it is still not a great idea to let everyone look inside it.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .