slock
slock copied to clipboard
Possible privilege escalation vulnerability in the Automatic Shutdown feature
The feature is an excellent idea, and i absolutely love it, but second i saw the NOPASSWD
option i instantly thought about how i could exploit something like that. Anything user writeable and root executable is a super easy way to do local privilege escalation, hell, i've done it before. Honestly that is the only thing stopping me from putting this on my daily driver laptop right now..
[username] [hostname] =NOPASSWD: /usr/bin/systemctl poweroff
[username] [hostname] =NOPASSWD: /usr/bin/shutdown -h now