Conversation
Exporting the blacklist wrote it to /tmp/mintUpdate/blacklist, then mintupdate-automation read that path as root after pkexec authentication. Another local user can replace the file (or plant a symlink) while the authentication dialog is open, so root appended arbitrary lines or the contents of any file, e.g. /etc/shadow, to world-readable /etc/mintupdate.blacklist. Pipe the blacklist to the helper on stdin instead.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
"Export blacklist" in Preferences writes the list to
/tmp/mintUpdate/blacklist, then runspkexec mintupdate-automation blacklist enable, which reads that path as root and appends it to/etc/mintupdate.blacklist./tmp/mintUpdateis shared (and created0777by the logger), so another local user can swap the file while the authentication dialog is open:/etc/shadowor/root/.ssh/id_rsagets its contents copied into world-readable/etc/mintupdate.blacklist*orlinux*makemintupdate-cliskip those updates during automatic upgrades(#155 was closed with "nothing is read from /tmp/mintUpdate".
add_user_blacklistwas added after that.)This pipes the blacklist to the helper on stdin, so root never opens a file in
/tmp. If stdin is a terminal (manual run) nothing is imported, the same as before when the tmp file was missing.Tested:
add_user_blacklistappends piped input, does nothing with empty stdin, and returns immediately on a tty. I have not run the full pkexec flow; pkexec passes stdin through (the same asecho … | pkexec tee).