Arch Linux

jamesh1999

Member

Registered: 2018-07-03

Posts: 1

Any obvious security issues with this getty configuration?

Hi all,
With the goal of extreme laziness, I have written this into /etc/systemd/system/getty@tty1.service.d/override.conf :

[Service]
ExecStart=
ExecStart=-/usr/bin/agetty -n -o MY_USERNAME %I $TERM

Essentially, I would like my username to automatically be entered in on the first virtual console since I am the only user of my computer. Then, because I have a fingerprint reader working, all I need to do to log in is scan my finger.

None too surprisingly, the man pages for agetty warn about security issues when using the -o flag. Since I am not accepting any user input with -n and relying on the fingerprint reader I was wondering if this was safe from a security perspective?

Thanks,
- James

Awebb

Member

Registered: 2010-05-06

Posts: 6,688

Re: Any obvious security issues with this getty configuration?

The man page is very specific about its security concerns, I'm not sure what else to tell you.

SECURITY NOTICE
If  you  use  the --login-program and --login-options options, be aware that a malicious user may try to enter lognames with embedded options, which then get passed to the used login program.  Agetty does check for a leading "-" and makes sure the logname gets passed as one parameter (so embedded spaces will not create yet another parameter), but depending on how the login binary parses the command line that might not be sufficient. Check  that the used login program cannot be abused this way. Some  programs use "--" to indicate that the rest of the commandline should not be interpreted as options.  Use this feature if available by passing "--" before the username gets passed by \u.