1

I would like to use homebrew on my new M1 mac, but I am concerned about some of the potential security vulnerabilities associated with /usr/local/. Basically this:

https://applehelpwriter.com/2018/03/21/how-homebrew-invites-users-to-get-pwned/

It looks like some people have mitigated this for Intel Macs by installing homebrew on a dedicated non-root user account and restricting /usr/local/ write access to that user, like this:

Improving security of homebrew installation (ownership of /usr/local)

Is a similar precaution necessary on the Apple Silicon version of homebrew, given that it now installs by default to /opt/homebrew/? If so, how would I go about setting that up?

1 Answer 1

2

The risk mentioned in your first link doesn't depend on the directory Homebrew is installed in, it comes from the fact that a user-writeable directory exists early within PATH which allows an attacker to "shadow" a command like sudo. So the situation hasn't changed in regard to this.

PS: IMHO, the additional risk was and is rather small. The user installing Homebrew (which is then also the user having write access to /opt/homebrew) needs to be Administrator anyway. And as Administrator you can install a shadowing command in /usr/local/bin even without Homebrew.

6
  • But they only need to be an administrator during initial install of Homebrew. Afterwards, their login has rwx on that directory and subdirectories. Commented Apr 7, 2022 at 20:53
  • @MarcWilson Not sure I understand. Yes, the admin user has rwx on these directories, but you still need to be logged in as that user to install anything there.
    – nohillside
    Commented Apr 7, 2022 at 21:08
  • They had to be an admin at install time. They do not have to be an admin later. But they still have rwx on the directories. Homebrew is just bad design, assuming that the Mac is a single-user machine. Commented Apr 7, 2022 at 21:13
  • @MarcWilson How can a non-admin user write to a rwxr-x-r-x directory owned by an admin user? Maybe a specific example with usernames would help?
    – nohillside
    Commented Apr 7, 2022 at 21:18
  • We're talking past each other. If the login is an admin when the software is installed, and is not an admin later, they are still the owners of the directory and have rwx on it. Where I work no Mac user is an admin on their machines. Commented Apr 7, 2022 at 21:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .