RE: MagicHat - 12 - Web interface

Workshopshed — Wed, 13 May 2015 11:01:26 GMT

Was thinking about this today. Swapping out the "console" with your own application on the serial port should close what I see as a big back door on the Yún. If you have control over the Atmel32U4 side then you've also got root access to the Linux side. I'd not be surprised if there was a way that a "user" could flash their own code onto the Atmel32U4 side from Linux in turn granting elevated privilege on the Linux side.

I was wondering how that /bin/ash --login command could be made to run as a lesser user but this is actually a better solution.

I'll likely do the same and listen on a serial port but with my language of choice which is Python.

Thanks,

Andy

RE: MagicHat - 12 - Web interface

Workshopshed — Tue, 12 May 2015 08:46:52 GMT

I'm not sure you have broken the control separation principle there. The Atmel32U4 knows only of the serial port and sends data down that. If you changed your format for the web client then you'd need to also change the Node application but you would not necessarily need to change the Atmel32U4 code so the separation is still there. Equally if you change the format sent from the Atmel32U4 the you'd only need to change the next level to keep sending the old format to the WebClient.