yaourt non-root-user installation is a major securtity risk #78
Description
Running yaourt as root is considerably more secure than the recommended non-root-user installation, precisely for this reasoning:
- Yaourt package installations require root access in virtually all instances
- Therefore the root password is queried and entered all the time if not executed as root
- Anyone who creates a malicious AUR package can do a simple UID check and then either exploit the system directly, or fake the root password prompt (including the yaourt output that preceides it)
- The probability that a non-forged AUR package contains unintentional installation-only malicious code is comparably low
- Revealing the root password to an attacker, by typing it into yaourt, has a whole lot more exploit value than just gaining root access. E.g. no further programs, scripts or otherwise obvious or error-prone implementations are required to gain remote access if ssh is enabled, no obvious alterations to the system need to take place. The root password could also be in use by the user for PGP keys, email, other systems, future systems and thus those could be compromised as well. To reveal the root password by typing it into a terminal, is much more dangerous than root access alone.
Conclusion:
Yaourt enforces a much more hazardous exploit advantage by querying the root password during installation process. Yaourt should never ever require the user to enter the root password, because the prompt can never be validated to be authentic.
Instead if necessary, it should run commands that are deemed as insecure for root execution as a non-root user by itself. If that is currently not possible, root-only installation should be preferred (with security warning) and password prompt for user installation disabled entirely. A yet more secure but more annoying temporary alternative is to only dump pacman package files, which then can be installed as root in a completely separated process and terminal. Querying the root password however, when previously running user installation scripts, can never be secure and should be avoided at all cost.