You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Presently, system binary paths are determined by reading the PATH environment variable. This is problematic from a security perspective, as it could potentially lead to code execution (symlinks, manipulation of PATH, etc.). One potential mitigation is to determine the locations of the executables required at startup without relying on PATH. This could be accomplished through system fingerprinting, e.g. "we know the current system is Ubuntu < 14 therefore check these paths".
This can be completed after the refactor is completed, as that'll make fingerprinting more reliable and provide a concise and deterministic (mostly) list of the executables (and paths) required.
The text was updated successfully, but these errors were encountered:
Presently, system binary paths are determined by reading the PATH environment variable. This is problematic from a security perspective, as it could potentially lead to code execution (symlinks, manipulation of PATH, etc.). One potential mitigation is to determine the locations of the executables required at startup without relying on PATH. This could be accomplished through system fingerprinting, e.g. "we know the current system is Ubuntu < 14 therefore check these paths".
This can be completed after the refactor is completed, as that'll make fingerprinting more reliable and provide a concise and deterministic (mostly) list of the executables (and paths) required.
The text was updated successfully, but these errors were encountered: