0

In my Arch Linux installation with Gnome 3.28, I recently noticed that I can enter with Nautilus in the private directory /root and see the files inside while Nautilus is started without root rights. In addition I can create directories everywhere in the filesystem as a non-root user when I start nautilus like this :

$ nautilus admin:///

How is it possible while Nautilus do not have the root rights ? For the moment, it's a very strange security hole for me...

  • Do you have a NFS share on your machine? What happens if you run the command ping admin? – dr01 Apr 27 '18 at 13:02
  • No I haven't any NFS filesystem on my machine but when I run the ping admin command, I get this : 64 bytes from assistance.tech.numericable.fr (82.216.111.26): icmp_seq=1 ttl=58 time=17.5 ms – daiSKeul Apr 27 '18 at 13:05
  • 1
    It should ask for either the root password or your own password, depending on your system’s setup; but it will use cached authentication tokens if they are available (again depending on setup). Have you tweaked pkexec & co.? – Stephen Kitt Apr 27 '18 at 13:07
  • No i haven't tweaked that but when I run pkexec it directly starts a root shell without asking me for any password... – daiSKeul Apr 27 '18 at 13:10
  • Did you check it really doesn't have root rights? Something like suid bit set? – Philippos Apr 27 '18 at 13:10
1

Linx/Unix working as it should. System root files are not invisible, but they should be off-limits for writing. And some files you can see, but not read (e.g. /etc/shadow).

0

My problem was caused by an insecure configuration of the sudo system. When I installed my Arch Linux system and to have the hability to execute commands without the root account, I added directly my username in the sudoers file like this :

martin ALL=(ALL) ALL

It worked very well with sudo but not at all with polkit. With this configuration, when I just typed pkexec in my shell, it opened a root shell without asking me for any password. But when Nautilus tries to access the /root directory, he execute the pkexec command. So that I could go in this directory without any password with my normal user account.

To correct the problem, I put my user in the wheel group and uncomment this line in the sudoers file

# %wheel ALL=(ALL) ALL

In conclusion, it's not a security breech in Nautilus but an insecure configuration I made...I'm sorry.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.