With the recent #CIFSwitch #Linux #Kernel #Venerability being exposed, time has come for a rewrite and rethink of some basic Linux internals.

There is no need for a crypto graphic authentication to be done by root user or by a user having CAP_SYS_ADMIN privileges. A separate user with a single cryptographic privilege should suffice. A user incapable of loading shared libraries.

Helper and services ought not to run with root like it was done for cifs. Rather a restricted user ought to be used.

𝙯𝙚𝙧𝙤-𝙘𝙡𝙞𝙘𝙠 𝙇𝙞𝙣𝙪𝙭 𝘽𝙡𝙪𝙚𝙩𝙤𝙤𝙩𝙝 𝙗𝙪𝙜 𝙘𝙝𝙖𝙞𝙣 𝙡𝙚𝙖𝙙𝙞𝙣𝙜 𝙩𝙤 𝙧𝙚𝙢𝙤𝙩𝙚 𝙘𝙤𝙙𝙚 𝙚𝙭𝙚𝙘𝙪𝙩𝙞𝙤𝙣

A security researcher at Google has disclosed long-awaited details of zero-click vulnerabilities in the Linux Bluetooth subsystem that allow nearby, unauthenticated attackers “to execute arbitrary code with kernel privileges on vulnerable devices”.

https://youtu.be/qPYrLRausSw

#linux #bluetooth #bug #rce #venerability #google #bluez