[gentoo-user] Re: How many ways are there for a user to increase their permissions?

[Lie Ryan]

On 04/18/10 11:02, Jonathan wrote:
> On Sun, 18 Apr 2010 08:29:37 +1000
> Lie Ryan <lie.1296@×××××.com> wrote:
>
>> sudoedit is mainly just a shortcut for "sudo $EDITOR" (plus doing a
>> few things).
>
> sudoedit is safer then sudo because sudoedit runs as root but nano
> (The editor) runs as your user.
> sudoedit uses a fixed path which is compiled into the program

Yes, that's the "few things" part, sudoedit does solves a couple of
security issues that you'd have if you start editor manually, probably
calling it "just a shortcut" is too much undermining.

>> Everything above (su,sudo,policykit,polkit) are just sugar for
>> permission bits (owner,group,others+SUID,GUID); attempting to give
>> finer control over the permissions or provide convenience services.
>
> Mess up the configuration and you may as well hand out the root
> password.

They're much better than manual management though, which is unless
you're forty-two security wizard in one body you will get it wrong.

>> Most security holes in Linux comes from a SUID program that lets
>> untrusted programs into the "trusted-space".
>
> 53 SUID or GUID programs on my system!
> Why does cdrecord have SUID set?

No idea.

>> I found sudo, although very handy for desktop, is a huge security
>> hole. And is inadequate for any secure system. This is simply
>> because if you run a program as sudo, then in the next five minute
>> you start a malicious program *without* sudo; the malicious program
>> can gain root access by stealing your previous sudo's timestamp
>> (yes, it can steal the timestamp without being explicitly invoked
>> with sudo[1]). Before running a potentially untrusted program, you
>> must explicitly kill your sudo timestamp with `sudo -k` or set sudo
>> to not use timestamp. Better yet, don't use sudo on secure systems.
>
> Wow... I never thought about that. I run sudo on my system 4 to 6
>> times a day if not more. Can tell me the setting please.

Setting for the timeout? See `man sudoers` and look at
timestamp_timeout. Setting for allowing program to steal timestamp?
Don't worry, it's already default.

> I had a quick look at man pages and Gentoo docs but I did not see it.
> Gentoo sudo guide [1] could use a update about this. it was right
> under my nose but I missed it...
>
> If some leaves they PC for 5 mins you could run
> "nano ~/.bashrc" and add "export PATH=/home/user/.bin:$PATH"
> then make a file called "sudo" write something to nick the password
> and by it on to sudo and then clean up after it self.

I believe the developers of `sudo` considered security against malicious
people with physical access to the computer is out of their scope.
Problem is, that means malicious people only need to trick a sudoers
into running a piece of complex code and say "you're not running my
script with sudo, so the script can't do no harm to system".

When I first used sudo, I thought by invoking sudo for trusted program
only and omitting sudo for everything else and thought the system would
be secure. That's a false sense of security. As long as you're a
root-sudoers, all program you run can gain root access any time they
need to. They just need to daemonize and poll every few minutes for an
updated timestamp.

> Just for fun I did that to one of my terminal tabs, with the script
> running "echo HAHA!".

I once written a script that have this in the first line:

if [ $UID != 0 ]; then
   sudo $0
   quit
fi
# do business that requires root

the script runs without asking password if I still have active timestamp
from running another program. How convenient! (and makes me shivers)