Hacker News Reader

Comment by avian | Hacker News Reader

Why does it matter if Firefox ran as root or not? I agree it's terrible practice in principle. But most people will run Firefox as their ordinary user, which normally has full access to the files in their home directory.

If someone gets arbitrary code execution under your user, they can erase/encrypt your files. Who cares if the OS files are safe. All the data you really care about will be gone.

View on HN

agree. ordinary user is absolutely sufficient. I'll now present a sophisticated privilege escalation method that most of us won't notice (me included, sarcasm off):

  alias sudo='/usr/bin/sudo echo something evil && /usr/bin/sudo'

I don't think it matters that he used his root account.

Edit: Maybe I'm wrong with my opinion, you can disable ASLR using your root rights... https://askubuntu.com/a/318476

Edit: Last exploit for Linux remote exploitation with Flash is from 2015 https://www.rapid7.com/db/modules/exploit/multi/browser/adob... or did I miss something here?

I use /usr/bin/sudo <>

So they check .bash_history and then they realize they just need to also `alias /usr/bin/sudo`.

Hm. How about ‘sudo’ <> ? i.e. quote the command?

Based on the sibling comment to yours, I don't think bash supports this. zsh allows you to make a \'sudo\' alias though, so it depends on your shell.

At least in bash, quoting the command disables any alias. Maybe also in zsh?

zsh seems to have much more flexible alias rules than bash:

    > alias \'sudo\'='ls -a'
    > 'sudo'                
    .  ..

If they have access to your .bashrc they can also alter your PATH and create a script named sudo somewhere they have write access to that carries the malicious payload. So you're not gaining much by adding the quotes.

> So they check .bash_history and then they realize they just need to also `alias /usr/bin/sudo`.

    $ alias /usr/bin/sudo=whatever
    bash: alias: `/usr/bin/sudo': invalid alias name

Oh, fair point. Not all shells support this apparently. zsh does:

    -> alias /usr/bin/sudo='ls -a'
    -> /usr/bin/sudo
     .  ..

I'm going to make a separate account just to run the web browser, xhost +localhost && su -c web-browser unprivileged-user

If you're using xwindows they can just install a keylogger

As an attacker, I test for sudo -n. If it succeeds, I have root. In most cases I do not need it however. SSH key trusts, SSH multiplexing and bad posix permissions are more than enough to get me anywhere and grab anything.

There was a zero-day for Flash being exploited ITW just a few days ago.

I didn't think any browser on Linux still supported Flash.

There may be things an exploit can do as root that wouldn't work under your user to break out of the adobe flash "sandbox". But yeah, the real recommendation is to get rid of flash and kill it with fire. The security of free software isn't fullproof but good riddance from the web to that particular closed source blob.

It will come back as WebAssembly.

What makes you think that? WebAssembly will at least not be single implementation, closed-source, no-maintenance like Flash.

I am betting someone will bother to create a SWF to WebAssembly translator, maybe even Adobe.

The whole point of security and good practices is to make harder for those arbitrary codes to be executed (or for whatever other flaws to be exploited, until they're fixed). Running a browser as root is not good practice. Doesn't mean that something bad will happen, but it's more or less line laying the cheese on the ground and expecting mice not to go after it. Even if you have none around, you just shouldn't risk it. At all. Unless you know exactly what you're doing.

This is why I wish people took mandatory access control more seriously. But to make it really pervasive and useful you need something like what Android has, where the file format mandates MAC profiles for the app. Even Red Hat cannot maintain SELinux profiles for every package in every repo, and even then third parties would complain about having to write the profiles just for RHEL / Fedora packages.

It is something the entire ecosystem would have to, at once, agree to make happen, and then standardize mandated MAC profiles in every package format. So basically never.

Firefox has some sandboxing on Linux, though it's quite recent.

It had level 2 content sandboxing from FF54, and level 3 (which has write and read access restrictions) with FF57. https://wiki.mozilla.org/Sandbox#Current_Status https://wiki.mozilla.org/Sandbox#Content_Levels_2

Thanks. The post is more than a few months old, it predates FF 54 (released in July 2017).

Its possible to run firefox with fewer privileges so that the only thing it could delete are your recent downloads.

Reply on news.ycombinator.com