Is giving myself write permission on my Python `site-packages` directory a way to avoid `sudo pip` risks?

1

1

I understand that there are security risks involved in installing pip under sudo, but for various reasons I would like to continue installing my packages in site-packages (on OSX 10.9), which currently requires sudo for pip to work.

Would simply giving myself permission to write to site-packages avoid these issues? Are there new security risks associated with doing so? Or perhaps the alternative is to create a new user who owns site-packages, specifically for use with pip?

Note that this is not a question about using virtualenv to avoid this problem.

orome

Posted 2014-01-11T03:27:58.883

Reputation: 205

Answers

2

Yes, you're opening up yourself to a huge security risk. Many system utilities are written in Python that runs under root privilege. If you give yourself write privilege to the system site-packages, you're risking that any program that runs under you (not necessarily python program) can inject malicious code into the system site-packages and obtain root privilege. If you create another user specifically to own the system site-packages, your vector of attack is only malicious setup.py. It's best not to touch the system site packages, and use virtualenv.

Lie Ryan

Posted 2014-01-11T03:27:58.883

Reputation: 4 101

So if I create a user for pip and give him access to site-packages the only risks I run are (1) that the execution of setup.py itself will do something malicious in site-packages (and nowhere else) and (2) that something malicious that ends up in site-packages will do damage anywhere that any code I run can, correct? Isn't (2) inescapable anyway, for any Python installation? – orome – 2014-01-11T14:23:58.293

1@raxacoricofallapatorius: it is inescapable, yes, but the impact is different with system site-packages which is regularly run with escalated privileges and virtualenv-ed site-packages which normally runs under your account. – Lie Ryan – 2014-01-11T18:15:47.193

But does wouldn't virtualenv then pose the same risks as my taking ownership of the systems site-packages? – orome – 2014-01-11T19:25:35.783

@raxacoricofallapatorius: if you run a software with root privilege, you have to make sure that the software and any libraries that it uses cannot be modified by anyone other than root. This includes if you're running a python program that requires root privilege inside a virtualenv. – Lie Ryan – 2014-01-11T19:40:12.530

Asked: 2014-01-11T03:27:58.883

Viewed: 676 times

Active: 2014-01-11T04:57:19.510