0

Dislaimer: Only an occasional *nix user. Just curious.

I was reading https://security.stackexchange.com/questions/232924/is-sudo-almost-useless where the question raises the point

Once an attacker has a shell as your sudoer user (or just compromised a local process enough), he/she can use one of the many privilege escalation tool ...

and answers show how an attacker that has compromised the user account can easily compromise sudo or any other privilege escalation mechanism, e.g. by injecting a fake sudo into ~/.bashrc.

One answer states

so long as you can avoid interacting with a fake login screen, you can mitigate this by having separate administrative and non-administrative user accounts

which got me thinking, that compromising root via a sudoer would be much harder if sudo, or really any privilege escalation mechanism, couldn't be faked with the same users rights that uses said privilege escalation mechanism.

So, as a user, how would I make sure that the privilege escalation mechanism used cannot be tampered with by myself without prior privilege escalation?

Note: xkcd/1200 applies, of course.

2
  • 1
    It is not clear what you are asking. However it is possible to not give a user sudo permissions, or to give permission to only run certain commands with sudo. See man sudoers Jun 10, 2020 at 21:01
  • Also don't forget that sudo is not a mechanism to prevent "hackers" from taking over the computer once they've taken over a user account. It's a mechanism for multi-user systems to give some users additional privileges in a controlled manner, and to allow sysadmins to protect themselves against stupid mistakes by allowing them to work from non-root accounts.
    – dirkt
    Jun 10, 2020 at 22:13

1 Answer 1

0

If you want to protect an account against certain possible results of being compromised then take away the permission to do so. Set .bashrc and the other files (for bash and the other shells in /etc/shells) to immutable.

Or use Apparmor / SELinux to limit write access to those files.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.