20 ms·

Does 'chattr +i .bashrc' reliably prevent this? Always seemed sensible to me. Then again, there are a few files getting sourced by the shell and I am not sure I

• mjmas 17d ago
  The attacker could use `chattr -i .bashrc` with the same privileges before editing your bashrc. A better way would probably be to use `sudo chown 0:0 .bashrc`. Also you will want to do the same to .profile (because of LD_PRELOAD etc). And also do the same to any directories in your $PATH (~/.local/bin etc)
  • jijijijij 17d ago
    > The attacker could use `chattr -i .bashrc` with the same privileges before editing your bashrc. No. Setting flags requires root privileges, sudo was implied. At least on my system. > Also you will want to do the same to .profile (because of LD_PRELOAD etc). Yeah, that's what I meant with additional files sourced by the shell. I knew about .profile, but I am not sure that's all of it. I think different distros may be set up differently in this regard. Also I am pretty sure, you can define function overwrites/aliases and execute code in any file getting sourced, it's not just LD_PRELOAD attacks.