> The attacker could use `chattr -i .bashrc` with the same privileges before editing your bashrc. No. Setting flags requires root privileges, sudo was implied.

> The attacker could use `chattr -i .bashrc` with the same privileges before editing your bashrc. No. Setting flags requires root privileges, sudo was implied. At least on my system. > Also you will want to do the same to .profile (because of LD_PRELOAD etc). Yeah, that's what I meant with additional files sourced by the shell. I knew about .profile, but I am not sure that's all of it. I think different distros may be set up differently in this regard. Also I am pretty sure, you can define function overwrites/aliases and execute code in any file getting sourced, it's not just LD_PRELOAD attacks.