Post #1539671
2025-11-21 07:35 UTC
@nik @daandemeyer @pid_eins ok but isn’t the problem in this case that in both cases a user is able to write undesired files in /etc that’s supposed for admin configs? I feel like sshd checking the owner of the files is a nice bonus but that shouldn’t be relied on as you imply. I assume there will be a possibility to configure what/if a person can do with run0?
Replies (1)
-
@nik@toot.teckids.org 2025-11-21 07:37
@breiti @daandemeyer @pid_eins No, the problem is that with --empower, a user can create a file that is supposed to be writable only for root, but after that, the file *is writable without being root or using run0 at all*, because it is owned by the regular user instead of root.