slock icon indicating copy to clipboard operation
slock copied to clipboard

Possible privilege escalation vulnerability in the Automatic Shutdown feature

Open beomusxyz opened this issue 2 years ago • 3 comments

The feature is an excellent idea, and i absolutely love it, but second i saw the NOPASSWD option i instantly thought about how i could exploit something like that. Anything user writeable and root executable is a super easy way to do local privilege escalation, hell, i've done it before. Honestly that is the only thing stopping me from putting this on my daily driver laptop right now..

[username] [hostname] =NOPASSWD: /usr/bin/systemctl poweroff
 [username] [hostname] =NOPASSWD: /usr/bin/shutdown -h now

beomusxyz avatar Jan 21 '22 13:01 beomusxyz