Comments (3)
Hello,
I was thinking about this feature some time ago and I wasn't sure, if it wouldn't add potential security issue. I can imagine the situation, when this script has wrong write permissions and it executes something dangerous as root (e.g. rm -rf --no-preserve-root
).
I am still not 100% sure about the security, but I agree this would be really nice feature.
from emptty.
You are right, if somebody has the permission to install service, there should not be an issue with trust.
Temporarily lowered permissions would be the best way in matter of security, however it could be quite annoying to set up that.
I think an user could be trusted. Just in case, there will be make install-motd-gen
option, that creates default /etc/emptty/motd-gen.sh
with correct permissions (744).
from emptty.
Understandable. In one way you could assume that the script is safe because whoever enabled the emptty service did so with sudo permissions. I guess it could be possible to temporarily lower your permissions to an "emptty" user to execute the script and redirect any errors - including lack of proper permissions - to the log file.
from emptty.
Related Issues (20)
- Selection mode: don't ask to choose session if there's only a single option HOT 2
- Provide pre-built binaries HOT 6
- Message about locked account does not get through HOT 1
- Help needed with configuring a wayland session for river
- Terminal emulators have default path set to '/' HOT 3
- custom logo, i want to ascii , and i only i3wm , and my i3wm is appimage, but i config emptty, it cannot auto i3wm HOT 1
- Not issue but question HOT 7
- Update github.com/msteinert/pam to v2 HOT 6
- PAM for Alpine Linux to repo
- Arguments from desktop entry are broken up HOT 4
- Use XDG Base Directory hierarchies HOT 6
- dbus-launch is probably not needed in systemd environment HOT 1
- About PATH again HOT 7
- Wrong data for XDG_SESSION_DESKTOP
- Feature request: Last user as default HOT 1
- Shutdown and reboot keyboard shortcuts HOT 8
- Automatic selection when only one choice HOT 2
- Show asterisks in password field HOT 1
- Black screen after login Ubuntu 24.04 HOT 13
- Screen locker HOT 3
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from emptty.