#polkit
These are public posts tagged with #polkit. You can interact with them if you have an account anywhere in the fediverse.
G◍M◍◍T @gomoot@mastodon.uno
Perfctl: una minaccia silenziosa ai server Linux
https://gomoot.com/perfctl-una-minaccia-silenziosa-ai-server-linux
#aqua #aquasecteam #blog #cve #linux #malware #news #picks #polkit #rocketmq #server #sicurezza #stealth #tech #tecnologia
Allarme sicurezza per i server Linux: Perfctl, il malware…
Gomoot : tecnologia e lifestyle Scopri le ultime novità in fatto di hardware,tecnologia e altroHerunterfahren und Neustart unter Ubuntu 22.04 deaktivieren:
Mit nur zwei Befehlen verhinderst du effektiv, dass Remote-Benutzer:innen einen virtuellen PC mit Ubuntu 22.04.4 LTS neu starten oder herunterfahren können.
https://andersgood.de/kurz-notiert/herunterfahren-und-neustart-unter-ubuntu-22-04-deaktivieren
@thomy2000@social.linux.pizzaLooking into #Polkit and #Firewalld for... reasons. Was browsing through the #DBus interface for Firewalld and found this. I immediately had a movie scenario in my head when I read about panic mode.
"Sir, multiple incoming connections. They are entering the mainframe. What do we do?!"
"We don't have a choice. Do it!"
"But Sir..."
"DO IT! ENABLE PANIC MODE, NOW!!"
Anyways, time to dig further into the documentation.
@jdlbt@techhub.socialError: org.freedesktop.NetworkManager.wifi.scan request failed: not authorized.
This one is quickly eating away my resolve to setup my own Raspberry Pi based astrophotography control computer from scratch...
@brauner@mastodon.social#pidfds in #polkit!
https://gitlab.freedesktop.org/polkit/polkit/-/merge_requests/154
Sweet! Great work by @bluca
When building with libsystemd support, query the systemd…
gitlab.freedesktop.org
@tac0shell@hackers.town@c0nsid3rate I've taken and failed OSCP 4 times (number 5 coming in January!). I think I used #polkit to privesc in number 2.
Rooted another OSCP machine this morning. There is no other exploit that has been more widespread and easy to leverage than pwnkit (CVE-2021-4034). I've simply lost count of the the number of machines I've been able to use this on to get root access from a low-privilege account. For people who do this kind of stuff, this post is a cold take, but I just wanted to come here and state the obvious. #OSCP #pwnkit #polkit #CVE-2021-4034 #Linux #pkexec #setuid
From the Ubuntu website: "A local privilege escalation vulnerability was found on polkit’s pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn’t handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it’ll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine."
One thing that I think we've lost over the last 20 years is "audio cues" #linux #foss #kde #gnome #opensource -- the desktop used to give a lot more audio feedback as to the events & status of events.
Empty the recycle bin? It had s simple audio cue play
Copy a folder? You have a audio cue to communicate success.
New email? Cue AOL charming & cringy "You've got mail.wav"
OS Startup? You feel like you are getting excited to get something done withe Windows XP - 7 and early 2000s Ubuntu startup sounds.
I think this principle could be taken so much farther -- perform a #rsync Why not have a audio cue for both Success.ogg and Failure.ogg -- or what about #polkit password verification, you are multi tasking on the phone or doing something in your office -- having a cue to redirect your attention to that you need to enter a password would be helpful.
Same thing goes for #pacman #yay and #paru in #archlinux
There are times you are compiling a program and it needs extra privileges to install but you don't notice it -- it would make a huge difference if we had a hook system and could Enable/Disable audio cues & notifications -- that would be a huge improvement.
I could really see this also bringing a lot of value in #linuxphone space, with #ubuntutouch #postmarketos #sxmo and others.
Its really hard to know what your missing when its been so long since you had it.
Plug in a USB Flash Drive? Audio Cue
Connect / Disconnect your phone to your computer? Audio Cue
Remote SSH Connection logs into your machine? Notification & Audio Cue.
With the right sound packs there is so much room for improvement -- #steamdeck #steamos v3 does a good job with this too giving subtle cues as you navigate the UX, startup, shutdown, etc...
@fabiscafe@mstdn.socialDoes anyone have a nice and simple example of a #python script that involves #policykit / #polkit to ultimately write a file to a root-owned directory?
Linux system service bug gives root on all major distros, exploit released
A vulnerability in Polkit's pkexec component identified…
www.bleepingcomputer.com
RightToPrivacy & Tech Tips @RTP@fosstodon.orgSee above toot for the demo video using the local root #exploit for #Polkit/#pkexec as an example in a intro talk on #linux #permissions/#privileges.
Learn more on the vulnerability behind it here:
#polkit #Exploit #Security #infosec #Cybersecurity #FOSS #News
https://www.bleepingcomputer.com/news/security/linux-system-service-bug-gives-root-on-all-major-distros-exploit-released/
A vulnerability in Polkit's pkexec component identified…
www.bleepingcomputer.com