From owner-freebsd-questions@freebsd.org Thu Feb 28 14:00:39 2019 Return-Path: Delivered-To: freebsd-questions@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 570971508620 for ; Thu, 28 Feb 2019 14:00:39 +0000 (UTC) (envelope-from albin.liden@gmail.com) Received: from mail-wr1-x42f.google.com (mail-wr1-x42f.google.com [IPv6:2a00:1450:4864:20::42f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 37FC86C137 for ; Thu, 28 Feb 2019 14:00:38 +0000 (UTC) (envelope-from albin.liden@gmail.com) Received: by mail-wr1-x42f.google.com with SMTP id w17so22051839wrn.12 for ; Thu, 28 Feb 2019 06:00:38 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:from:date:message-id:subject:to; bh=jYDW84JeUj+zjrWiSYXJlIVcKggRDErImtaZBLJQscY=; b=V3wN8B5ZggCu6vK0EEo+NmebK2WefuACa0++JZsyuD5aNRY6GAJJHe4i8xA9038kra d2Lov7zD0ZM1I7Gza+Yj3qvRxDfR+VvQBkRWkCufATaDYdE2UytLgQwBR34wz69lEy70 t1XOuMS3eOHGMb3COS0Q8F0dw4L7qdbaWQpUJgwtVuOciIywX7L8fyUX9zRqUEd0NOc6 ihi1ArTDYmYip1uolPB0a3TvH6H07RYOlOlrsMWueSj/CVZllnnuXNIDvksAkLmluhqo 8b3vf+OYt742URP4/06Yv6uATsnFOvIHbYlB0g8wpB7AUfHk+4N+hZ3eYKHSZ66weuMX BmHw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=jYDW84JeUj+zjrWiSYXJlIVcKggRDErImtaZBLJQscY=; b=tUYKaQrPgfDCGD59a3mu993i1Yb4fntsFMx2ejI2+dUoSgOcZ05fY4Hym0Ne04XwLA qcrBkhIRgNmsEfiICBQMkat9MmpDW/NKsewOIhTy4jhWZq2H5/pW/PBZjAaveD4aTU6q IU9OoT4j/aB6jYe6mfpBFEgE+fcAikRs8RIYF/7VO8EL8IjC0ocSMwVevsW5GgQ3erox xSEVWGxYoByHeMKe8L5NwG8Dw7ERzrYNhG5zkxWmQt7Pt4nircUmUVGAXe5E6pSjVIBf U3koFL519rvHJdfcB0mAaJa8N0O9hvob0cOtniLhjwjTxCBJPfywkC3I3oaTcC3rBWH2 zPrA== X-Gm-Message-State: APjAAAURqFgAOvw9lY0lB+J6S4mog+qIm/ESy/hhTtxsNtR5FNzM90RL 5YM8yc2AXMKgKM1repxdCoWSb/wT+ZS+q9PeDPd0CflE X-Google-Smtp-Source: APXvYqzLzGS3I9En7LOWOrW4G6uji9B1FRIIUA9sliR6OHSU82YkAaIeEekmyY0BNSI/hgUGzQXF4OwZlOrtFxiXr3Q= X-Received: by 2002:adf:eac2:: with SMTP id o2mr6313577wrn.0.1551362436901; Thu, 28 Feb 2019 06:00:36 -0800 (PST) MIME-Version: 1.0 From: =?UTF-8?B?QWxiaW4gTGlkw6lu?= Date: Thu, 28 Feb 2019 15:00:22 +0100 Message-ID: Subject: possible vulnerability To: freebsd-questions@freebsd.org X-Rspamd-Queue-Id: 37FC86C137 X-Spamd-Bar: ------ Authentication-Results: mx1.freebsd.org; dkim=pass header.d=gmail.com header.s=20161025 header.b=V3wN8B5Z; dmarc=pass (policy=none) header.from=gmail.com; spf=pass (mx1.freebsd.org: domain of albinliden@gmail.com designates 2a00:1450:4864:20::42f as permitted sender) smtp.mailfrom=albinliden@gmail.com X-Spamd-Result: default: False [-6.37 / 15.00]; R_SPF_ALLOW(-0.20)[+ip6:2a00:1450:4000::/36]; FREEMAIL_FROM(0.00)[gmail.com]; TO_DN_NONE(0.00)[]; DKIM_TRACE(0.00)[gmail.com:+]; DMARC_POLICY_ALLOW(-0.50)[gmail.com,none]; MX_GOOD(-0.01)[cached: alt3.gmail-smtp-in.l.google.com]; NEURAL_HAM_SHORT(-0.64)[-0.639,0]; FROM_EQ_ENVFROM(0.00)[]; RCVD_TLS_LAST(0.00)[]; MIME_TRACE(0.00)[0:+,1:+]; FREEMAIL_ENVFROM(0.00)[gmail.com]; ASN(0.00)[asn:15169, ipnet:2a00:1450::/32, country:US]; TAGGED_FROM(0.00)[]; DWL_DNSWL_NONE(0.00)[gmail.com.dwl.dnswl.org : 127.0.5.0]; ARC_NA(0.00)[]; NEURAL_HAM_MEDIUM(-1.00)[-1.000,0]; R_DKIM_ALLOW(-0.20)[gmail.com:s=20161025]; FROM_HAS_DN(0.00)[]; TO_MATCH_ENVRCPT_ALL(0.00)[]; NEURAL_HAM_LONG(-1.00)[-1.000,0]; MIME_GOOD(-0.10)[multipart/alternative,text/plain]; PREVIOUSLY_DELIVERED(0.00)[freebsd-questions@freebsd.org]; RCPT_COUNT_ONE(0.00)[1]; IP_SCORE(-2.72)[ip: (-9.24), ipnet: 2a00:1450::/32(-2.27), asn: 15169(-2.02), country: US(-0.07)]; RCVD_IN_DNSWL_NONE(0.00)[f.2.4.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.0.4.6.8.4.0.5.4.1.0.0.a.2.list.dnswl.org : 127.0.5.0]; RCVD_COUNT_TWO(0.00)[2] Content-Type: text/plain; charset="UTF-8" X-Content-Filtered-By: Mailman/MimeDel 2.1.29 X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 28 Feb 2019 14:00:39 -0000 Please do forward this to the right team Wzup u BSD-govs! I just thought about something related to BSD/UNIX and Linux security What would happen if a user did execute a script which put the system into a single user mode during when the OS i completely in multi-user-mode that would lockup the passwd for the root to change his password WITHOUT having it wouldn't that be a risky action, by a possible hacker maybe even a vulnerability, if you have forgotten to lock the mode when in multi-user sufficiently if the user just went into that mode, without any root shell he would be root and he would have access to mount and also to passwd just pondering about this, realized it could be a possible backdoor or other way round the otherwise strict security no need to reply, simply check this, if you believe I could be right another possible way around security would be to reload the freebsd boot loader, but NOT reboot the system. then run in single user mode such as nintendo once had a bug which allowed exploits to access the 3ds-mode, when it was unlocked, 3ds roms may be ran without restrictions thank u guys have a good one!