[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <54DDB5EC.8060708@debian.org>
Date: Fri, 13 Feb 2015 08:29:32 +0000
From: Simon McVittie <smcv@...ian.org>
To: oss-security@...ts.openwall.com
Subject: Re: Re: CVE request: sudo TZ issue
On 13/02/15 07:05, Rich Felker wrote:
> On Wed, Feb 11, 2015 at 10:20:03AM -0700, Todd C. Miller wrote:
>> However, there is no real way for the application to tell that it
>> is being run by an unpriviliged user and that operations that would
>> otherwise be safe (opening a user-specified time zone file) may be
>> dangerous.
>
> Why does sudo run the target program with both effective and real ids
> set to root? Why not run with only the effective uid set to root?
Firstly, as far as I'm aware, sudo's design is "su, but better" and
setting the real uid matches how su works.
Secondly, becoming root is not the only reason why you might want to use
sudo or su; they can also be used to drop privileges from root to
non-root, or switch from one non-root user to another. Under the current
design, the target program can't switch back; if the real uid was still
that of the original user, it could.
Thirdly, if every program and every library is expected to be aware of
Unix arcana like "if euid != uid, then the results of getenv() are
untrustworthy", then that would effectively put every program invoked
via sudo, and every library that they link, into the trusted set. AIUI,
part of the point of sudo is that it does the checks and acts as the
trust boundary, so that the target program doesn't have to.
S
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
