While reading about bashrc, I ran into the following fundamental problem of terminal-only machines:
If I run malicious software with a restricted account, it could edit my ".bashrc" file and set an alias to logout. The alias would point to the malicious executable and upon logout it would fake a login screen and obtain passwords to non-restricted accounts and possibly root.
While the quick solution seems to be to set "chattr +i .bashrc" as root, making the file immutable for non-root users, I don't think this is sufficient. Shells are very complex and there might be other ways of defining aliases which I do not know about.
I thought about what the core of the issue is and to me it seems that terminal-only machines allow full control of the UI which is displayed to running software.
So one solution would be to wrap the terminal in a larger piece of UI which displays the current logged in user. This would take away some of the screen though. Another solution would be a special reserved key on the keyboard which forces logout and cannot be re-defined by any aliases and cannot be monitored by any non-root software.
Is there some software which provides this or a similar solution?