Skip to content

Preen 0.1.1

Choose a tag to compare

View all tags
@youxufkhan youxufkhan released this 31 Oct 19:09
· 8 commits to main since this release
v0.1.1
b5da4d2

Security fix for the root helper. Use this release instead of 0.1.0.

Fixed

  • The privileged pkg-remove action now accepts only valid Debian package names. Before this fix, a name ending in + (which apt reads as "install") or a pattern such as a* could reach apt-get as root through pkexec. Package and snap names must now end in a letter or digit and contain no pattern characters, and the package must match an installed package exactly.
  • Every package apt would remove together with the chosen app now passes the same system-package checks as the app itself.
  • flatpak-remove requires an exact installed application id.

Exploiting this needed a process running as you that could start pkexec preen helper and get past the password prompt (or run within polkit's 5-minute grace period after you entered it).

Install (Ubuntu / Kubuntu 26.04)

wget https://github.com/youxufkhan/preen/releases/download/v0.1.1/preen_0.1.1_amd64.deb
sudo apt install ./preen_0.1.1_amd64.deb

Everything else is as in 0.1.0. Verify downloads with sha256sum -c SHA256SUMS.

Assets 5
Loading