List of Unix binaries that can be used to bypass local security restrictions

Re:List of Unix binaries that can be used to bypass local se... by westurner on Friday July 07, 2023 @04:36PM (#36637980)

> The only thing root access would give somebody on my machine is to uninstall some random packages or corrupt my install.

While I agree that compromise of an unprivileged account has significant costs, technically superusers do have significantly greater access to the system and so there are greater levels of risk.

RedoxOS is reimplementing Linux userspace utilities in rust in order to avoid C vulns in suid binaries; like ping, which requires raw sockets for ICMP (which most of us only need the Echo Request capability of)

Superuser: https://en.wikipedia.org/wiki/Superuser

Capability-based security: https://en.wikipedia.org/wiki/Capability-based_security

Privilege-based escalation: https://en.wikipedia.org/wiki/Privilege_escalation

Principle of least privilege: https://en.wikipedia.org/wiki/Principle_of_least_privilege

MAC: Mandatory Access Control: https://en.wikipedia.org/wiki/Mandatory_access_control

[ Parent | on HN ]

Re:List of Unix binaries that can be used to bypass local se... by kefyras on Friday July 07, 2023 @06:06PM (#36638905)

>in suid binaries; like ping

ping hasn't required suid in ages, there's net.ipv4.ping_group_range and CAP_NET_RAW.

[ Parent | on HN ]

Re:List of Unix binaries that can be used to bypass local se... by westurner on Saturday July 08, 2023 @05:23PM (#36648921)

"How can I identify if a binary file is set-user-ID?" https://unix.stackexchange.com/questions/192588/how-can-i-id...

    test -u "$(type -p ping)" && echo "the suid bit on ping is set"
    ls -l "$(type ping)"

[ Parent | on HN ]