Post #1539636
2025-11-21 10:25 UTC
@daandemeyer @funkylab Do I get that correctly that this is safe from e.g. manipulation by a debugger because the newly spawned process is not a child of run0 but of systemd, and therefore the debugger can normally not attach?
Replies (1)
-
@daandemeyer@mastodon.social 2025-11-21 10:51
@felixs @funkylab A debugger will be able to attach just fine. I've opened https://github.com/systemd/systemd/pull/39839 to clarify that other processes of the selected user will be able to mess with the empowered session. So using run0 --empower gives malicious processes a vector to infiltrate the system. But so does sudo -E PATH or using sudo to execute anything in your home directory or using sudo -s, ....