Re: Debian package manager privilege escalation attack
❦ 12 August 2021 10:31 +02, Ansgar:
>> I give myself password less sudo to "apt update" (without additional
>> options), "apt upgrade" (same), "apt full-upgrade" (same). I was
>> thinking this should be safe, but now I need to check if the pager is
>> properly restricted when displaying NEWS file.
>
> These are not safe to be run under `sudo` without giving the invoking
> user full access. As a random example: dpkg's conffile prompt offers to
> open a shell.
Ack. I'll avoid this from now on.
--
Keep it simple to make it faster.
- The Elements of Programming Style (Kernighan & Plauger)
Reply to: