search

zolrath / wemux

Multi-User Tmux Made Easy
MIT License
3.63k stars 139 forks source link

Insecure socket sharing #18

Closed filipechagas closed 11 years ago

filipechagas commented 11 years ago

The scenario: Sharing a development environment to pair programming:

In the "main" user, I create a wemux session:

wemux start

Now, my friend connects to my computer, via ssh, with a limited user (a sandbox user). This guy could run wemux pair and everything works fine. But, if he decides to give me trouble, he could run:

tmux -S /tmp/wemux new -s shared

Now, my friend has a session with my user, outside my supervision, and it doesn't appear in any of the wemux listing commands, and I'm not able to kick this guy using wemux commands. Alongside our happy pair programming session, my friend could be ruining my home folder (or worse), and it's not possible to me to know he's doing that.

zolrath commented 11 years ago

Unfortunately due to how wemux is implemented on top of tmux I don't have the ability to restrict commands issued outside the wemux command. I would recommend only pairing with those you trust!