search

YoCodingMonster / OpenFreezeCenter

For Those running Linux Distro on MSI laptops. This is the Graphic User Interface application meant for Fan control in Linux.
GNU Affero General Public License v3.0
363 stars 61 forks source link

`root_permissions.sh` is a massive security risk #135

Closed pghvlaans closed 1 year ago

pghvlaans commented 2 years ago

/etc/sudoers shouldn't be modified without the user's knowledge in the first place. However, adding ALL=(root) NOPASSWD:/usr/bin/nohup to /etc/sudoers for the running user is extremely dangerous, as any command prefaced with sudo nohup would be run as root without a password prompt.

TEST AND REPORT ME

If this isn't fixed within the next couple of weeks, I'll report you, all right. To GitHub.

TheArcaneBrony commented 2 years ago

reporting is probably overkill, it also seems like their english is quite limited, hence "report me" instead of "report back to me".

pghvlaans commented 2 years ago

As it is, the program essentially runs as root without the user's knowledge; personally, I think reporting would be in order if that isn't changed.

Reading it again, the quip about reporting was inappropriate. I definitely should have phrased that differently.

TheArcaneBrony commented 2 years ago

If you look at my PR, ive gotten rid of the entire root script and I'll probably add a check to the main script to just exit out with "must run as root", as root is required to write to the EC data, instead of this repo's current behavior of self-elevating.

Edit: just wanted to add that it kind of works on my laptop, if you happen to be on an MSI GF75 Thin 9SC, you might want to check out BeardOverflow/msi-ec. It might work on other models but so far that's the only known working model.

YoCodingMonster commented 1 year ago

Please see the new pre-release and in the tell if having issues in the discussion of that release tab only.

https://github.com/YoCodingMonster/OpenFreezeCenter/releases/tag/v3.2.1