Q:

Possible Security threats and mitigations while accessing `/root` through any browser?

I asked this question on Unix Stackexchange. How to access /root directory from a browser?
I got an answer (in a comment by @dsstorefile) that It can be accessed either way :

By running chmod 0777 root
By running browser as a Root User.

I think It's just a listing of the contents in the directory (for that I maybe wrong) but I want to know :
What could be Possible security risks/threats associated of accessing /root directory from the browser in each case ?

A:

The issues are that anyone on your system will be able to maliciously elevate themselves to root privileges. Doing either of these things is a very bad idea. To address your specific scenarios:

Making root's home directory mode 0777 means that all users will be able to read, write, enter, and execute any files in that directory. Because many sensitive, privileged processes use that as their home, making it world-writable could allow any unprivileged process to tamper with root's home. For example, malicious code in /root/.profile would be executed with high privileges any time the root user logs in. There are many ways to exploit you in this scenario.
Running your browser as root is also extremely dangerous. It means an exploited browser will run as root, rather than as your normal user. This is not a hypothetical threat. Someone actually did run their browser as root and got infected with ransomware! Additionally, a regular browser is not designed to run with a privileged context and so does not take the necessary security precautions to prevent an unprivileged local user from exploiting it. For example, if you run your browser in your regular user's environment, but as root, then a modified configuration file or browser extension (in your regular user's home) could exploit it to elevate to root.

You could make /root mode 0755, which would make it writable only by root, but would allow everyone else to enter and read it (including your browser). Normally, it does not contain any sensitive information, but it is still not a great idea to let everyone look inside it.

