console gave me root without password

[Upayavira]

Binary package hint: friendly-recovery

My system wasn't behaving, so I booted to the recovery mode. It gave me a lovely menu, allowing me to reconfigure X, etc, and also to drop to a console.

That console gave me root, without asking me my password. This means that anyone who gains physical access to my PC can gain complete access to everything simply by rebooting.

I appreciate that they could gain such access by extracting my HDD, but this is just way too easy.

Upayavira

[Kees Cook (kees)]

Anyone with physical or console access can boot it with alternate init arguments, avoiding any kind of authentication (extracting the harddrive is not needed). For system that require a high level of physical security, various additional mechanisms of protection are recommended like disk encryption, BIOS passwords, etc.

[Kevin Funk (kfunk)]

I dont get the reasoning here. I still lock up my door at home although anyone with "physical access" could break in.
Why dont you just prompt for a password after recovery? Of course anyone with physical access can just do anything with your computer, but why do we have passwords at all? You could also remove the user passwords when argumenting like that.
Please add a prompt here, someone just needs to restart your system and he can hose your files, that's not acceptable.

[Kees Cook (kees)]

Hello! At the time, it was not clear that there had been a regression to the recovery mechanisms (i.e. friendly-recovery was a new package for Hardy). This has been fixed now (I have marked this bug as a duplicate of the bug that was fixed). Thanks!