Pwnkit: Local Privilege Escalation in polkit's pkexec (CVE-2021-4034)

Re:Pwnkit: Local Privilege Escalation in polkit's pkexec (CV... by yrro on Wednesday January 26, 2022 @08:23AM (#30085073)

If you add your users to the 'audio' group then they can SSH into machines to eavesdrop.

    $ getfacl -p /dev/snd/pcmC0D0c
    # file: /dev/snd/pcmC0D0c
    # owner: root
    # group: audio
    user::rw-
    user:sam:rw-
    group::rw-
    mask::rw-
    other::---

On my systems, the 'audio' group is empty. The ACL of the audio device (and other devices with the `uaccess` tag) is adjusted by udev when the owner of the active console session changes.

(I don't know if the scheme is able to revoke access to a running process, but it's still a step up from a single, static 'audio' group).

[ Parent | on HN ]

Re:Pwnkit: Local Privilege Escalation in polkit's pkexec (CV... by 0xbadcafebee on Wednesday January 26, 2022 @08:38AM (#30085193)

How many Linux users really expect a hacker to 1) be on their local network, 2) find a zero-day exploit in SSH, and 3) want to eavesdrop on them? I'm pretty sure I'd get struck by lightning while attacked by a shark before that ever happened

[ Parent | on HN ]

Re:Pwnkit: Local Privilege Escalation in polkit's pkexec (CV... by foxfluff on Wednesday January 26, 2022 @08:57AM (#30085406)

I feel like this whole thing is driven by corporate interests. It would make sense in a context where a machine has multiple users (or: anyone at work can use their credentials on any workstation), which is not uncommon in a work environment. It seems largely irrelevant for a single-user desktop.

It irritates me that the Linux environment is constantly growing more complex to account for scenarios that are not relevant for me, and it's hard to opt out. That complexity is not zero-cost; I've been hit by many a bug (and have wasted a lot of time working around..) related to things that exist on my system yet serve no real purpose for me.

I guess it's the year of the Linux desktop when it gets corporate enough, and those who want a comfortable free operating system will be looking for alternatives :)

[ Parent | on HN ]

Re:Pwnkit: Local Privilege Escalation in polkit's pkexec (CV... by yrro on Wednesday January 26, 2022 @10:41AM (#30086803)

I have personal experience of this happening in lab environments.

And there's no SSH exploit necessary. I'm not talking about a hacker from the internet, I'm talking about a malicious co-worker.

The old permission model of "just add everyone to the audio group" is not sufficient.

[ Parent | on HN ]