Suppose my web browser or any other web-connected app has a minor security hole that won't allow an attacker to run code but will allow them to write a piece of text into a text file I own.
On a typical Linux distro however, certain text files, such as
.bashrc, are bound to get executed (for all intents and purposes), and in the case of
.bashrc quite frequently.
There's not much an attacker can't do if they can execute shell code.
How can one protect themselves from this?
Would it be a good idea to keep such config files along with executables in user-writables paths
chmod -w? Is this security concern far-fetched?