Hacker News Reader

Comment by Aachen | Hacker News Reader

Impact: local users on the system, including dummy service users like 'nobody', can perform actions on a running Mozilla VPN daemon via D-Bus, including activating the VPN with a server of the attacker's choice, deactivating the VPN, obtaining log files to see when the user historically activated the VPN, and clearing log files

So you need to have a local shell on the system of the user you want to attack. Not cool, it violates permission boundaries that are there for a reason, but the headline sounded to me like a remote authentication bypass (I'm not into the whole D-Bus/Polkit thing) which this is not

View on HN

Local unprivileged shell is not an unreasonable thing to get on linux since most people are building random software regularly. Among the things i know i should be doing but i don't: using a dedicated user for building everything; sandboxing the build process using some bwrap/container.

Privesc is also trivial on desktop linux :P so if your barrier is "but I'm an unprivileged user" it's likely not enough. You need a proper sandbox if you want to make escalation difficult.

ex: Desktop Linux's running X have a trivial escalation path; any program can read all keystrokes across all users. You type your sudo password in, you're screwed.

Or if the attacker is running as your user they can just modify your bashrc, aliases, etc, to do a whole bunch of things - like having `sudo` go to an attacker controlled binary - that one will work on the server, too!

So yeah sandboxing builds is super important because "unprivileged users" are almost always one trivial step away from full root.

There's no reason for your build user to require access to X.

Or even most (all) namespaces of the host!

Beyond just minding privileges of the user, building in a container/chroot/etc is nice from a cleanliness/repeatability perspective.

For those interested in the Fedora packaging ecosystem -- look into fedpkg and mock

https://docs.fedoraproject.org/en-US/package-maintainers/Pac...

This is a great attack vector on corporations that use shared servers for their users.

I don't think they would be running the Mozilla VPN client on those servers, though.

Reply on news.ycombinator.com