Using an unprivileged user and `su`/unrestricted (not limited to a closed set of trustworthy executables by sudoers) `sudo` to obtain root perms on a typical GNU/Linux system without restrictive MAC polices doesn't offer any considerable security improvement over using root directly for all activities the unprivileged user is used for. It does, though, provide plenty of feel-good inconvenience (typing all these `su`s when needed), even reinforced by some application developers, whose software refuses to run as root. Prove me wrong.
УНЯНЯ. У нас есть немножечко инфы
об этом пользователе. Мы знаем, что он понаписал,
порекомендовал и даже и то и другое сразу.
А ещё у нас есть RSS.
НАКОСТЫЛЕНО
‰ cat ~/bin/skype
#!/bin/sh
# wtf xpra+xorg problems?
sudo -u skype killall -u skype
# https://xpra.org/trac/ticket/1388#ticket
sudo -u skype rm -f /home/skype/.xpra/l29ah-x201-99
LANG=en_US sudo -u skype xpra --socket-dir=/tmp --mmap-group start :99 --start-child=/opt/bin/skype --pulseaudio=no
# https://xpra.org/trac/ticket/1389#comment:4
sleep 3
#while [ ! -e /home/skype/.xpra/l29ah-x201-99 ]; do
# sleep 1
#done
xpra --socket-dir=/home/skype/.xpra/ attach :99 -d clipboard -z 0
К firejail прикрутили xpra, а к xpra - xdummy, и после некоторой обработки напильником теперь можно запускать браузер почти без тормозов в зааналенной прокладке для иксов (не даёт заниматься кейлоггингом, скриншоттингом и позволяет управлять доступом к клипборду), вебки и звука, в дополнение к имевшейся ранее анальной тюрьме для файлов и сети. Единственный наблюдаемый недостаток - не подсасывается DPI материнских иксов, из-за чего размер букв будет неестественный.
Для гентушников написал ебилд для сабвершона:
USE=x11 emerge firejail '=xpra-9999'
firejail --x11=xpra /usr/bin/firefox
Это правда?
[16:45:45]<woky> you can get user access to pretty much every Java developer in your MITMinit these days
[16:46:06]<woky> they don't give a shit =)
[16:46:57]<woky> (i'm not java developer)
[16:50:56]<L29Ah> how come?
[16:52:07]<woky> well, almost every java fuck these days use crap like maven, or maybe some other tool, but sonatype (maven fucktards) runs central Jar repository and every Java build tool uses this repo to fetch deps
[16:52:41]<woky> they were incompetent enough to make tool that dls executable code (even build tool plugins for things like "clean") without any security whatsoever
[16:52:50]<woky> and best part:
[16:53:58]<woky> this year they were finally able to add SSL but you have to pay for that =D
[16:54:41]<L29Ah> WAT
[16:54:44]<L29Ah> pay for HTTPS?
[16:54:46]<L29Ah> WAT
[16:55:12]<woky> lol yep, Java world is unbelieveably crazy,
[16:55:40]<woky> so average Java dev will just create his pom and run stuff like "mvn clean" which will download and run clean plugin (which does rm -r target but runs 5 seconds)
[16:56:19]<woky> download from insecure http://repo1.maven.org ofc
[15:21:28]<angry_vincent> L29Ah: mitm make no sense
[15:21:56]<angry_vincent> L29Ah: and even it's possible, in theory, Gentoo has no soultion for it aswell
[15:24:05]<angry_vincent> L29Ah: it's better to walk and breathe fresh air instead tossing with such ultra-paranoid thoughts in mind
Цоперайт © 2010-2016 @stiletto.