5 ms·

Smaller, less features, ideally less vulnerabilities.

masklinn 5y ago
Although it is annoyingly and quite critically missing a replacement for `sudo -e` / sudoedit (or was last time I checked).
- dotancohen 5y ago
  What is wrong with `sudo vim /etc/foo`? I feel that it's better than `sudo -e`, but would love to see an example where `sudo -e` is better.
  - josepmdc 5y ago
    `sudo vim` will not load your user's vimrc, sudoedit will
    - masklinn 5y ago
      It will also run your entire editor as root, which may not be something you want.
      - dotancohen 5y ago
        I actually would prefer the editor binary to run as root, rather than have my VIM config available. Any malware that could replace my system VIM would already have access to do whatever it wants to anyway. But malware to alter my own VIM configuration has a much lower barrier to entry.
    - dotancohen 5y ago
      Which is arguable an attack vector. Depending on how careless the user is, there is far more likely a chance that malicious code is found in .vimrc than is found in the VIM executable.
      - fragmede 5y ago
        sudoedit runs your editor as you, not root, so unless I'm misunderstanding you, no such attack surface exists.
        masklinn 5y ago
        They’re probably referring to the attack surfaces of the extensions you have loaded in your normal configuration, as opposed to the probably empty environment of root.
  - masklinn 5y ago
    > What is wrong with `sudo vim /etc/foo`? Aside from forcing vim onto innocent users? > I feel that it's better than `sudo -e`, but would love to see an example where `sudo -e` is better. It is way worse than `sudo -e`, because it runs the entire editor as root, whereas `sudo -e` runs a few file copies / move as root. So `sudo -e` has a significantly lower amount of stuff in the "secure zone", and thus, much in the same way `doas` is more secure than `sudo`, `sudo -e` is a lot more secure than running the entire editor. It also works with anything you can set as $EDITOR. Some editors (like vscode) will outright refuse to run as root by default.
    - dotancohen 5y ago
      > Aside from forcing vim onto innocent users? Actually, `sudo -e` forces VIM onto innocent users. You are free to `sudo nano` if that's your preference. > `sudo -e` runs a few file copies / move as root. Interesting, thank you, I did not know that the editor is not run as root with -e. So presumably that means that it will have my environment, e.g. will run my .vimrc? Though that could be an attack vector too.
      - masklinn 5y ago
        > Actually, `sudo -e` forces VIM onto innocent users No, it does not. It runs whatever EDITOR is set to (technically the first set of SUDO_EDITOR, VISUAL, and EDITOR). > So presumably that means that it will have my environment, e.g. will run my .vimrc? That is correct. > Though that could be an attack vector too. Only on the specific file, which would usually be a lot more noticeable unless the attack specifically manages to recognise and target sudoedited files while closing the buffer.
        dotancohen 5y ago
        > Only on the specific file, which would usually be a lot more > noticeable unless the attack specifically manages to recognise > and target sudoedited files while closing the buffer. I've seen far more sophisticated attacks than that. Though vimscript itself is kind of a barrier to entry ))
  - zbuf 5y ago
    "sudo -e" prevents you committing a file with a syntax error, because that instantly locks you out of all sudo access. The replies about security are interesting, but I think they are over-complicating this!
- mixmastamyk 5y ago
  alias suedit=‘doas …’
  - masklinn 5y ago
    That is not at all what sudoedit does.
    - mixmastamyk 5y ago
      Not at all? Might wanna brush up on the manpage. The temp file is a feature but not essential to getting work done.
      - masklinn 5y ago
        > The temp file is a feature but not essential to getting work done. The entire point of sudoedit is to reduce the attack surface, without that it's absolutely useless since you can just `sudo` whatever editor you prefer.
        mixmastamyk 5y ago
        Exactly. And could be trivially implemented.
throwaway984393 5y ago
On the one hand, I get that not everybody needs all the features of sudo, but on the other.... Sudo is way more useful than doas. If you really go through all its functionality, you start using it in ways you didn't think to before. You can have a custom AuthZ solution and automatically inherit sudo permissions based on groups. It supports a configurable askpass. You can background jobs, change working directory, selectively pass or set environment variables, set $HOME, use a login shell, preserve origin groups, use a chroot, read a password from STDIN, override the shell, set a timeout. And of course the sudoedit features. I know we all like programs that "do one thing well", but sometimes the best way to support all the use cases we want is a big honking program.

Although it is annoyingly and quite critically missing a replacement for `sudo -e` / sudoedit (or was last time I checked).

dotancohen 5y ago
What is wrong with `sudo vim /etc/foo`? I feel that it's better than `sudo -e`, but would love to see an example where `sudo -e` is better.
- josepmdc 5y ago
  `sudo vim` will not load your user's vimrc, sudoedit will
  - masklinn 5y ago
    It will also run your entire editor as root, which may not be something you want.
    - dotancohen 5y ago
      I actually would prefer the editor binary to run as root, rather than have my VIM config available. Any malware that could replace my system VIM would already have access to do whatever it wants to anyway. But malware to alter my own VIM configuration has a much lower barrier to entry.
  - dotancohen 5y ago
    Which is arguable an attack vector. Depending on how careless the user is, there is far more likely a chance that malicious code is found in .vimrc than is found in the VIM executable.
    - fragmede 5y ago
      sudoedit runs your editor as you, not root, so unless I'm misunderstanding you, no such attack surface exists.
      - masklinn 5y ago
        They’re probably referring to the attack surfaces of the extensions you have loaded in your normal configuration, as opposed to the probably empty environment of root.
- masklinn 5y ago
  > What is wrong with `sudo vim /etc/foo`? Aside from forcing vim onto innocent users? > I feel that it's better than `sudo -e`, but would love to see an example where `sudo -e` is better. It is way worse than `sudo -e`, because it runs the entire editor as root, whereas `sudo -e` runs a few file copies / move as root. So `sudo -e` has a significantly lower amount of stuff in the "secure zone", and thus, much in the same way `doas` is more secure than `sudo`, `sudo -e` is a lot more secure than running the entire editor. It also works with anything you can set as $EDITOR. Some editors (like vscode) will outright refuse to run as root by default.
  - dotancohen 5y ago
    > Aside from forcing vim onto innocent users? Actually, `sudo -e` forces VIM onto innocent users. You are free to `sudo nano` if that's your preference. > `sudo -e` runs a few file copies / move as root. Interesting, thank you, I did not know that the editor is not run as root with -e. So presumably that means that it will have my environment, e.g. will run my .vimrc? Though that could be an attack vector too.
    - masklinn 5y ago
      > Actually, `sudo -e` forces VIM onto innocent users No, it does not. It runs whatever EDITOR is set to (technically the first set of SUDO_EDITOR, VISUAL, and EDITOR). > So presumably that means that it will have my environment, e.g. will run my .vimrc? That is correct. > Though that could be an attack vector too. Only on the specific file, which would usually be a lot more noticeable unless the attack specifically manages to recognise and target sudoedited files while closing the buffer.
      - dotancohen 5y ago
        > Only on the specific file, which would usually be a lot more > noticeable unless the attack specifically manages to recognise > and target sudoedited files while closing the buffer. I've seen far more sophisticated attacks than that. Though vimscript itself is kind of a barrier to entry ))
- zbuf 5y ago
  "sudo -e" prevents you committing a file with a syntax error, because that instantly locks you out of all sudo access. The replies about security are interesting, but I think they are over-complicating this!
mixmastamyk 5y ago
alias suedit=‘doas …’
- masklinn 5y ago
  That is not at all what sudoedit does.
  - mixmastamyk 5y ago
    Not at all? Might wanna brush up on the manpage. The temp file is a feature but not essential to getting work done.
    - masklinn 5y ago
      > The temp file is a feature but not essential to getting work done. The entire point of sudoedit is to reduce the attack surface, without that it's absolutely useless since you can just `sudo` whatever editor you prefer.
      - mixmastamyk 5y ago
        Exactly. And could be trivially implemented.

throwaway984393 5y ago

On the one hand, I get that not everybody needs all the features of sudo, but on the other.... Sudo is way more useful than doas. If you really go through all its functionality, you start using it in ways you didn't think to before. You can have a custom AuthZ solution and automatically inherit sudo permissions based on groups. It supports a configurable askpass. You can background jobs, change working directory, selectively pass or set environment variables, set $HOME, use a login shell, preserve origin groups, use a chroot, read a password from STDIN, override the shell, set a timeout. And of course the sudoedit features. I know we all like programs that "do one thing well", but sometimes the best way to support all the use cases we want is a big honking program.