Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

(BUG) Potential privilege escalation on Pi images #766

Closed
ptrlow1 opened this issue Sep 22, 2024 · 1 comment
Closed

(BUG) Potential privilege escalation on Pi images #766

ptrlow1 opened this issue Sep 22, 2024 · 1 comment

Comments

@ptrlow1
Copy link
Contributor

ptrlow1 commented Sep 22, 2024

Description

If pressing ALT+HOME (when a keyboard and mouse is connected to the Pi4) opens a new Chrome Incognito window, and clicking the gear in the "Block third-party cookies" section opens a new regular window, allowing someone to press F6 to access the address bar, which could allow for a arbatory command to be entered, or view files on the Pi's filesystem using "file:///" (example: "file:///etc/passwd" views the users on the system, etc.)

Acceptance Criteria

  • Disable the keyboard shortcut "ALT+HOME" to prevent someone from opening a Incognito window

Also disable Incognito mode completely, just for good measure
These sites have instructions on blocking Incognito mode:
https://askubuntu.com/questions/116319/how-to-disable-chromes-incognito-mode
https://thelinuxcode.com/turn-off-incognito-mode-google-chrome

Update: Incognito window is used, therefore ignore "Disable Incognito mode completely"

@sarcasticadmin
Copy link
Member

Closed via socallinuxexpo/scale-kiosk#7

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants