0

My user ~/.zshrc file has the following default privileges

-rw-r--r--

My understanding of user permissions is that any process spawned by my user will then have read/write permissions to this file.

In malicious hands this could probably be used to edit aliases or append a directory of the attackers choosing to the beginning of the $PATH. I'm concerned that a malicious program that I install on the user level could then trick me into somehow giving up my sudo password through this method.

Obviously I do trust most of the programs that I install to not be malicious, however, I do use npm as a package manager for my own projects which is commonly accepted to be a vector for malware due to the sheer number of dependencies each module and it's dependencies can have.

I know that running sudo npm install -g is really bad practice but is using npm as a user which has write access to your main shell configuration file almost as bad just with a few extra steps in between, or am I lacking an understanding of how user permissions/shell configuration/npm works?

If this is insecure, then have I somehow missed security good practice for handling node js projects?

  • If you don't trust a program it shouldn't be run under your account. Create a different account and run it from there. Make a separate user for npm projects if you are really concerned. – LawrenceC Jan 29 at 23:21
1

A program will be able to change permissions of your files. So, even if write permission is disabled, it does not matter… Yes, a program will be able to do what it wants if you run it regularly.

To prevent that, you have several solutions. For instance, you can run it in a container, use cgroups or Linux namespaces.

If you want to check your config files, you can put them under versioning and check for modification when running new shell, or check some checksum. But, from my point of view, it is not a good solution since a malicious programs can do a lot of different hacks, and you will only be protected from one scenario.

| improve this answer | |
0

Why does npm need a home directory? Glancing at /etc/passwd on one of my systems, I see a number of processes have their home directory set to root ("/"), /dev/null, or another directory not under /home (e.g. /sbin).

If you did that, there would be no ~/.zshrc file, & the process's environment would inherit the settings from /etc/zshrc.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.