4 ms·

Sudo can be configured to grant very limited access to specific users, to run specific programs, run as privileged-but-not-superuser, etc. [1] [1] https://www.

Sudo can be configured to grant very limited access to specific users, to run specific programs, run as privileged-but-not-superuser, etc. [1] [1] https://www.sudo.ws/man/1.8.15/sudoers.man.html https://www.sudo.ws/man/1.8.15/sudoers.man.html

ryanlol 9y ago
I'm aware, but the in the end that's a relatively uncommon configuration, and would still usually require the users password increasing difficulty of exploitation even further. Not only that, but in my experience people tend to screw up these setups most of the time allowing easy root shells without sudo vulns.
- wyldfire 9y ago
  > usually require the users password increasing difficulty of exploitation even further. Unless the user themselves is the perpetrator. They know their own password and the superuser believes that the system restrictions will grant them only the limited access that they specified.
  - ryanlol 9y ago
    I think at this point we've established just how few people this bug impacts.
    - wyldfire 9y ago
      I will concede that it's not time to panic, but it's a security bug and one that we know about. Let's continue to keep the bar high for successful exploits.
- SteveNuts 9y ago
  Are you saying that granting limited sudo access to only specific programs is rare? That's the standard way to do it in every large enterprise, you just don't grant sudo all. Only in the cloud space is the "sudo all nopasswd" a thing (ubuntu user on AWS).
  - rkeene2 9y ago
    Unless you are very particular about the commands added, most configurations end up being equivariant to ALL. Some examples I've seen: ip, less, vi, tar, cp, mv, mount, chmod, chown, zip, mysql, dd, ... Any of those and many many more allow for trivial jumping to any command as the target user and you're not improving your security posture compared to ALL, though you make some work harder and some mistakes less likely.
deleted 9y ago
[deleted]
quotemstr 9y ago
Right. Some people use sudo as a way to avoid having to provide setuid programs.

ryanlol 9y ago

I'm aware, but the in the end that's a relatively uncommon configuration, and would still usually require the users password increasing difficulty of exploitation even further. Not only that, but in my experience people tend to screw up these setups most of the time allowing easy root shells without sudo vulns.

wyldfire 9y ago
> usually require the users password increasing difficulty of exploitation even further. Unless the user themselves is the perpetrator. They know their own password and the superuser believes that the system restrictions will grant them only the limited access that they specified.
- ryanlol 9y ago
  I think at this point we've established just how few people this bug impacts.
  - wyldfire 9y ago
    I will concede that it's not time to panic, but it's a security bug and one that we know about. Let's continue to keep the bar high for successful exploits.
SteveNuts 9y ago
Are you saying that granting limited sudo access to only specific programs is rare? That's the standard way to do it in every large enterprise, you just don't grant sudo all. Only in the cloud space is the "sudo all nopasswd" a thing (ubuntu user on AWS).
- rkeene2 9y ago
  Unless you are very particular about the commands added, most configurations end up being equivariant to ALL. Some examples I've seen: ip, less, vi, tar, cp, mv, mount, chmod, chown, zip, mysql, dd, ... Any of those and many many more allow for trivial jumping to any command as the target user and you're not improving your security posture compared to ALL, though you make some work harder and some mistakes less likely.

deleted 9y ago

[deleted]

quotemstr 9y ago

Right. Some people use sudo as a way to avoid having to provide setuid programs.