Re:Omarchy: Any User Process Can Escalate to Root
by ahelwer on Sunday August 30, 2026 @01:18PM
(#49500653)
You need root in order to overwrite sudo in the first place I think, but yes password replay attacks are real. This is why I think it is a good idea to get a yubikey and use PAM to require a physical user presence check to acquire root privileges. You don't even need a password at that point. Unfortunately haven't figured out how to make this work over SSH.
[ Parent
| on HN ]
Re:Omarchy: Any User Process Can Escalate to Root
by lrvick on Sunday August 30, 2026 @01:26PM
(#49500736)
> You need root in order to overwrite sudo in the first place I think
You just need write access to .bashrc or similar.
> This is why I think it is a good idea to get a yubikey and use PAM to require a physical user presence check to acquire root privileges.
Unprivileged malware will be waiting with a root payload ready to fire the next time you tap your yubikey.
Re:Omarchy: Any User Process Can Escalate to Root
by ffsm8 on Sunday August 30, 2026 @01:25PM
(#49500719)
Look at the excerpt. They're not overwriting the sudo binary. The attack vector is real for malware running on a administrator user session which can be escalated to root via sudo.
It's a niche, but it's real. Esp. if you're targeting npm installed user scripts or similar
Re:Omarchy: Any User Process Can Escalate to Root
by porridgeraisin on Sunday August 30, 2026 @01:25PM
(#49500727)
No, the above attack writes that function into bashrc, meaning the next time the user runs sudo themselves, you harvest their password.
Re:Omarchy: Any User Process Can Escalate to Root
by Brian_K_White on Sunday August 30, 2026 @01:36PM
(#49500861)
You do not need root to run that shell function, nor to get it loaded into a shell's environment.
They didn't say anything about overwriting the sudo binary, and that is not required, which I think was their whole point was to show exactly how that is not required.