[Seek Help] security hole in deepin kernel testing
Tofloor
poster avatar
G4SP3R
deepin
2021-06-26 05:48
Author

Hello, I found a very serious security flaw in the testing version, this is an unacceptable flaw.

 

The 5.10.36 kernel files are exposed to being modified without super user permissions, because the user is assigned as owner and group instead of root, leaving the entire kernel to any modification or attack without the need to use even sudo.

 

This is caused by totally careless packaging, and it shows that they don't know how to pack and they don't know about safety.

 

Many packages in the store have the same problem, they are poorly packaged and application files can be modified and attacked without any hindrance, without using sudo or needing super user permissions.

 

This makes Deepin extremely insecure, vulnerable and easy to attack, these bad practices weaken or rather completely destroy the security mechanisms of GNU / Linux.

 

It is urgent and very important that they learn to pack correctly as soon as possible, and that these safety problems be corrected immediately.

 

You can check the compromised files with the following command 

 

LIST="/boot /etc /mnt /opt /srv /usr"; FAILS=$(for FOLDER in $LIST; do find $FOLDER -user $(whoami) 2>/dev/null; done;); if [[ $FAILS ]]; then ls -l $FAILS; fi

 

I attach the files with the results on my computer

 

Reply Favorite View the author
All Replies
Hello
deepin
2021-06-26 06:01
#1

Thanks for reminding

Reply View the author
SamLukeYes
deepin
2021-06-26 06:15
#2

Security and packaging issues need to be fixed ASAP. @ deepin-mq

Reply View the author
gongyf
deepin
2021-06-26 06:51
#3

革命还未成功!同志任需努力

Reply View the author
SamLukeYes
deepin
2021-06-27 06:40
#4

It appears that deepin developers are not quite active on this forum these days. What about opening an issue here?

Reply View the author
wtz
deepin
2021-06-29 03:03
#5

Some files and directories under /opt are made owned by user 1001 intentionally, in order to allow proper functionning of self-update of the parent application (e.g. Firefox, Zotero). This is a compromise between security and usability. If you care much about the security, you can fairly download packages from the developer's website and install them by yourself.

Other system-wide files (those in /boot, /etc, /usr/share, etc.) exposing to write access of normal users create real security holes, and should be corrected as soon as possible.

Reply View the author
G4SP3R
deepin
2021-07-01 10:13
#6

the problem persists https://bbs.deepin.org/post/222089

Reply View the author
G4SP3R
deepin
2021-07-01 10:14
#7
SamLukeYes

It appears that deepin developers are not quite active on this forum these days. What about opening an issue here?

https://github.com/linuxdeepin/developer-center/issues/2125

Reply View the author