Wireshark · Ethereal-dev: [Ethereal-dev] user plugins loaded even if root

[LEGO <luis.ontanon@xxxxxxxxx>]

Plugins in $HOME/.ethereal/plugins get loaded anyway whether they are
owned or not by the user running them.

That means that if ethereal is sudoed ( man sudo(8) ), as I imagine
some linux administrators want ethereal to be runt by users,  the code
in user plugins will be executed. That means that if I write, compile
and install a malicious plugin in my home dir (or any dir pointed by
$HOME) it would execute
with root privileges.

Should we load user plugins  only if owned by the user ethereal is
currently running?

--
This information is top security. When you have read it, destroy yourself.
-- Marshall McLuhan