Dispatch PR-tests with a PAT instead of github.token: a workflow run owned
by GITHUB_TOKEN does not emit a downstream `workflow_run` event, so the
chack-agent-pr-triage auto-merge job never fired for the bot PR. Also accept
the UNSTABLE merge state (the bot PR's `action_required` pull_request run
keeps it permanently UNSTABLE) and drop the explicit CI-master_test dispatch
since the PAT squash-merge's push to master already triggers the release,
avoiding a double release.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The PATH-derived portion of writeVB uses `sed 's/:/$|^/g'` to turn the
colon-separated PATH into an alternation regex. This produces patterns like
`^/usr/bin$|^/sbin$|^/bin` where every entry except the last gets a trailing
`$` anchor — making it an exact match on the directory name itself rather than
a prefix match on files inside it.
On modern merged-/usr distributions (Debian 10+, Ubuntu 20.04+, Fedora 17+,
Arch) `/bin` is a symlink to `usr/bin`, so `find /` returns `/usr/bin/bash`
rather than `/bin/bash`. The pattern `^/usr/bin$` does not match
`/usr/bin/bash` (the `$` prevents it), so a writable bash binary falls through
to the lower-severity writeB coloring (plain RED) instead of the 95% PE vector
RED/YELLOW.
Add explicit patterns for the common shell interpreters and env so they are
always flagged as 95% PE vectors regardless of PATH ordering or /usr-merge
layout:
/bin/bash /usr/bin/bash
/bin/sh /usr/bin/sh
/bin/dash /usr/bin/dash
/bin/zsh /usr/bin/zsh
/usr/bin/env
Co-authored-by: s1d3r <s1d3r@users.noreply.github.com>
* feat: detect hidden group access via newgrp (gshadow desync)
Problem: groups/id only show current session memberships
Fix: probe all system groups via newgrp to detect accessible groups not shown
Impact: identifies hidden access (docker, lxd, etc.) missed by standard checks
Real case: user present in gshadow docker group but not reflected in session
newgrp docker succeeds -> container escape -> root
* Update linPEAS/builder/linpeas_parts/6_users_information/19_Actual_groups.sh
fixed the command-injection vector.
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Apply suggestion from @Copilot
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Muthra <muthra@example.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: SirBroccoli <carlospolop@gmail.com>
