Ryan Hughes
ff4cf8afbc
[4.0.2] Close unprivileged input and SSH escalation paths
(cherry picked from commit 21b27c5aed)
19 lines
917 B
Bash
19 lines
917 B
Bash
echo "Drop the default input group grant, which allowed unprivileged keylogging"
|
|
|
|
# Membership of `input` gives raw read/write access to /dev/input/event*: any
|
|
# process running as the user can capture keystrokes and synthesize input. The
|
|
# blanket grant is unnecessary: the Xbox-controller and ydotool installers add
|
|
# the group themselves when those features are deliberately installed.
|
|
#
|
|
# Preserve membership where one of those opt-in features is present; removing
|
|
# it there would break the feature the user chose to install.
|
|
if id -nG "$USER" | grep -qw input; then
|
|
if pacman -Qq xpadneo-dkms &>/dev/null || pacman -Qq ydotool &>/dev/null; then
|
|
echo "Keeping $USER in the input group: controller or ydotool support is installed."
|
|
else
|
|
sudo gpasswd -d "$USER" input >/dev/null
|
|
echo "Removed $USER from the input group. Log out and back in to apply."
|
|
omarchy-state set reboot-required
|
|
fi
|
|
fi
|