2

I've been reading online that homebrew changing usr/local/bin to r/w could pose a serious security issue as usr/bin is the path after usr/local/bin.

Article found here: https://applehelpwriter.com/2018/03/21/how-homebrew-invites-users-to-get-pwned/

Is this legit and an actual safety concern? I'm new to linux paths and don't fully understand how they work. What other directories does homebrew modify? For reference I am using a Mac.

Improve this question
2
  • 1
    Is it a security issue? Yes. Is it a security issue that will affect a large number of people? Probably not. It assumes that someone on a machine has the ability to write to /usr/local/bin, which already requires either significant compromise or trusting another user on the same machine. Given how that's likely not how most users use their mac, I don't think it's a big problem in practice.
    – user163495
    Nov 16, 2020 at 11:06
  • I think that is a good way to put it. In addition, if the user was running malicious code, whether they ran it locally and messed up commands in the terminal or ran it as sudo and gave complete access to the system, the end result is the same.
    – Harrison G
    Nov 17, 2020 at 7:29

1 Answer 1

Reset to default
2

This is an interesting question, the article that you mention gives a great summary of the technical issues in this change.

Let's look at your question in more detail: "Is this legit and an actual safety concern?"

  1. Is it legit?

Absolutely the article is technically accurate. In summary by allowing more users to write to a directory that is high up the path it allows for some interesting types of attacks.

  1. Is it an actual safety concern?

If I may I think you are trying to ask "Should I be worried about this?". The reason I like to rephrase this is simple, there are plenty of issues out there that are legitimate security concerns that people choose not to do anything about. This can range from behaviour (connecting to public wifi) to bugs in software which the vendor has chosen not to fix.

Unfortunately, no-one can tell you whether a particular issue is worthy of taking action over without knowing much more about your environment and attitude to risk.

For example, I am ok (on my personal MacBook) to keep home-brew installed on the system with the default options. Why? Put simply the benefit I get on a system I use for development from having brew installed outweighs the risk.

Please note, this is my personal choice and not a recommendation for you!

If I was running a Mac based shared server I would be less comfortable with this, I would be trying to lock down as many accounts as I can and preventing most users from being able to impact global settings.

In summary, you need to consider your (or your organisations) attitude to risk and decide for yourself whether the changes that homebrew make during a default install are acceptable to you or not.

Improve this answer
2
  • I would go a bit into detail as to what the actual risk is, i.e. what would need to happen for an attacker to actually be able to exploit this. Otherwise great answer.
    – user163495
    Nov 16, 2020 at 14:24
  • @JamesWilson I like your analogy to what people do choose to ignore. It's true that the majority of computer users ignore common security issues from public wifi and reusing one word passwords. I suppose the question is if the security issue is a problem relevant to common users or computer enthusiasts? Clearly if one was running a server or multiple user accounts, write permission of key components of the operation system would be not ideal.
    – Harrison G
    Nov 17, 2020 at 7:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .