6 ms·

Sudo must be the program with the largest number of buffer overflows I’ve heard about. That news is repeating itself ever since I remember. Maybe a good time t

Sudo must be the program with the largest number of buffer overflows I’ve heard about. That news is repeating itself ever since I remember. Maybe a good time to plug doas, a simpler alternative to sudo from OpenBSD folks[1], developed partly due to security fears about sudo. It’s also been ported to Linux and is available in e.g. Alpine and Debian. [1]: <https://flak.tedunangst.com/post/doas https://flak.tedunangst.com/post/doas>

jmclnx 4y ago
I was thinking the same, this is the slackbuild for Slackware 15 https://slackbuilds.org/repository/15.0/system/opendoas/?search=doas https://slackbuilds.org/repository/15.0/system/opendoas/?sea... It also contains some information on how to setup doas on Linux
vbezhenar 4y ago
There must not be a single suid program in a safe system. The concept of suid bit is flawed and nothing but a hack. You can build sudo-like functionality using ssh @localhost and additional root user with special shell.
- yakubin 4y ago
  That to me sounds like moving the problem from a privileged binary to a privileged daemon and putting a network stack in the middle. I don’t see how it solves anything. Any way you can secure sshd you can probably apply to the suid binary as well.
- Sohcahtoa82 4y ago
  This requires enabling being able to log in as root, which I'd rather not enable.
- Beltalowda 4y ago
  And that sshd server is running as root, which is really just the same as setuid except with extra steps.
- mindwok 4y ago
  To be honest, your solution sounds far more hacky than a suid bit. A suid bit is effectively just a mechanism to implement privileged access in user space. I don’t see what’s hacky about that.
tetha 4y ago
Indeed, I've been looking around somewhat during off-time with a colleague how much we actually use of sudo, and what doas couldn't do. We're indeed looking at starting a migration, because some DNS based, LDAP integrated, PAM integrated, really complicated priviledge escalator is becoming kinda scary as of late. The biggest difference we found is that sudo is a little more convenient to manage with a config management solution, since each piece of config management code can just drop a file in /etc/sudoers.d. With doas, we have to coordinate a bunch of parts of the config management manipulating one file, /etc/doas.conf. This always turns out a bit messy. But maybe we'll just merge everything into one big and somewhat messy monster doas-conf-template with a ton of feature toggles and loops and go from there. But beyond that, almost all of our sudo rules are 2-3 patterns: Admin can sudo as everyone, zabbix/telegraf can run data gathering commands, and maybe some other automation triggers like pgbackrest wiping a postgres data dir during a restore, that's about it. All of those are pretty trivial doas rules all in all.
- yjftsjthsd-h 4y ago
  The biggest difference we found is that sudo is a little more convenient to manage with a config management solution, since each piece of config management code can just drop a file in /etc/sudoers.d. With doas, we have to coordinate a bunch of parts of the config management manipulating one file, /etc/doas.conf. Apparently whether it's used is configured at build time, because I get different results trying it on Arch and Alpine, but doas absolutely has a /etc/doas.d EDIT: Oops, apparently Alpine added that - https://git.alpinelinux.org/aports/tree/main/doas/configuration-directory.patch https://git.alpinelinux.org/aports/tree/main/doas/configurat...
  - TheBrokenRail 4y ago
    > EDIT: Oops, apparently Alpine added that This seems like a really weird thing for a distro to add themselves rather than upstream.
    - somat 4y ago
      not really, alpine really wanted it. openbsd did not, it was a simple patch. you are probably going to maintain a patchset anyway(for the port to alpine) might as well maintain one more to support a simple feature you really want.
seanw444 4y ago
Been maining opendoas for a while now. The main problem I have with it is that the "don't require a password for ___ seconds" timeout is unconfigurable as far as I'm aware. So you have to enter your password fairly frequently, which can be annoying on non-sensitive machines. But for simple systems that aren't running complex user privilege management, doas is very much a great replacement.
- galangalalgol 4y ago
  I don't see any tests on the github. Is there some way to do pipelines for open source projects that wouldn't require funding? Would a free gitlab tier account for stuff like this be within the TOS? I just find it kind of crazy how most of the open source ecosystem has no static analysis or unit tests. I'm not criticizing, I'm trying to figure out how to contribute.
  - bornfreddy 4y ago
    Github does allow (some amount of) GH Actions for free, as does Gitlab.
    - dathinab 4y ago
      It does but it's kinda a pain for use for anything but scripting languages in my experience. They way it scales doesn't fit well with C/C++/Rust/Scala/Java/etc. build systems and test runners. I'm also having problems with it at work all the time, like task randomly being reported as canceled after they already passed. Or task after completion hanging for well over 30min until some internal timeout triggers and they then get reported as failure. Or a task being reported as succeeded to the UI and as failed to follow up tasks. (All issues I ran into just in the last week :=(, some might be caused by us having to use local GH Actio runners due to how GH Actions work, but I also have seen all this problems before we started using local runners so probably not).
- 7839284023 4y ago
  > The main problem I have with it is that the "don't require a password for ___ seconds" timeout is unconfigurable as far as I'm aware. https://wiki.archlinux.org/title/Doas#doas_persist_feature https://wiki.archlinux.org/title/Doas#doas_persist_feature https://wiki.gentoo.org/wiki/Doas https://wiki.gentoo.org/wiki/Doas With the persist keyword doas can remember an authenticated user and will not require confirmation by password for five minutes.
ranger_danger 4y ago
- kaba0 4y ago
  Has absolutely nothing to do with the topic, and frankly, I rather trust a unified program with a set of functionalities done cleanly in a programming language over a set of random bash scripts trying to do the same, but failing. It’s not like you don’t have to communicate between them and it is goddamn bash.. I would make less error in binary.
zokier 4y ago
> It’s also been ported to Linux Last time I checked there were several different ports floating around. Now I see at least Debian has chosen opendoas, I guess people have mostly converged to that one. Also fun stuff like https://π.duncano.de/slicer69-doas.html https://xn--1xa.duncano.de/slicer69-doas.html The point being that while openbsd doas is undoubtedly very nice, the linux ports are separate projects
Veserv 4y ago
To put the relative simplicity into perspective, here is the official Github mirror of sudo: https://github.com/sudo-project/sudo https://github.com/sudo-project/sudo On the contributors tab: https://github.com/sudo-project/sudo/graphs/contributors https://github.com/sudo-project/sudo/graphs/contributors We can see that sudo has been maintained by one person for ~29 years who has single-handedly committed ~2,936,000 changes over that time resulting in a net increase of ~480,000. It is also being actively developed with ~270,000 changes resulting in a net increase of ~40,000 lines in the last twelve months. In contrast doas is, just eyeballing it, maybe ~500 lines and at most 1000 lines all together.
- efficax 4y ago
  why on earth is sudo so complicated. All I want it to do is: ensure authorization, raise privileges, call exec.
  - rob-olmos 4y ago
    Probably because of sudoers?
    - mordechai9000 4y ago
      The documentation describes the configuration as a context free grammar using EBNF notation. This is impressive, but maybe a little more complicated than I want to get with a basic security tool. I suspect most people who don't have to modify it very often are going to secondary sources, like tutorials or stack overflow, and copying examples from there.
      - tgv 4y ago
        IMO, a more complex grammar allows for better descriptions. The only real type of grammar simpler than CFG is a regular expression. That's pretty limited, although (the older part of) CSS doesn't need more than that. But as soon as you want a nested construction, hierarchy or simply nested parentheses, you need a CFG. If it's difficult to configure, the problem is the (configuration) language, not the power of its grammar. And there are excellent parser generators out there. You don't have to fear introducing bugs via them.
thayne 4y ago
It looks like doas is missing some important features sudo has, notably full I/O logging and wildcard and in the newest version regex support for matching arguments. The latter could maybe be worked around with wrapper scripts, but I don't know what you would do for logging. And the password persist option is experimental, and not configurable on Linux. If you don't need those features, doas is probably a good replacement. But if you do, it probably isn't an option.
- josteink 4y ago
  > It looks like doas is missing some important features sudo has … and wildcard and in the newest version regex support for matching arguments. Sometimes less is more. My immediate response to that is that it sounds like needless complexity which can be a source of errors, bugs and security-vulnerabilities. What typical use-cases do these particular features have?
  - ehutch79 4y ago
    For wildcards; Allowing a user to use systemctl with specific daemons, so ```systemctl * unit-name```, without a password. But anything outside of that I need a password.
    - Denvercoder9 4y ago
      It's actually good to not support such things, because it makes it way too easy to give more permissions than you intent to. In your example it effectively gives unlimited root access, as you can do `systemctl edit unit-name` and change the unit to run arbitrary programs as root.
      - claviola 4y ago
        That's all well and true, but it's an expected downside which you'd see with any software which needs to be properly configured to run. If a user doesn't know they should take this seriously by ensuring that a tool which potentially grants root privileges is correctly configured, that shouldn't stop others who know better.
uri4 4y ago
Or just uninstall sudo, at least on opensuse it is optional package.
ilyt 4y ago
As meme as it is, Rust rewrite wouldn't be out of place...
wyldfire 4y ago
> Sudo must be the program with the largest number of buffer overflows I’ve heard about. That news is repeating itself ever since I remember. That you've heard about. There's two big reasons: (1) people often don't try to spend a lot of time finding exploits for userspace programs that don't open network ports or perform privilege escalation. And (2) when they do find exploits in those programs, they don't make it to HN.
still_grokking 4y ago
> Sudo must be the program with the largest number of buffer overflows I’ve heard about. That news is repeating itself ever since I remember. libxml? zlib? PHP? The déjà vs are many…

jmclnx 4y ago

I was thinking the same, this is the slackbuild for Slackware 15 https://slackbuilds.org/repository/15.0/system/opendoas/?search=doas https://slackbuilds.org/repository/15.0/system/opendoas/?sea... It also contains some information on how to setup doas on Linux

vbezhenar 4y ago

There must not be a single suid program in a safe system. The concept of suid bit is flawed and nothing but a hack. You can build sudo-like functionality using ssh @localhost and additional root user with special shell.

yakubin 4y ago
That to me sounds like moving the problem from a privileged binary to a privileged daemon and putting a network stack in the middle. I don’t see how it solves anything. Any way you can secure sshd you can probably apply to the suid binary as well.
Sohcahtoa82 4y ago
This requires enabling being able to log in as root, which I'd rather not enable.
Beltalowda 4y ago
And that sshd server is running as root, which is really just the same as setuid except with extra steps.
mindwok 4y ago
To be honest, your solution sounds far more hacky than a suid bit. A suid bit is effectively just a mechanism to implement privileged access in user space. I don’t see what’s hacky about that.

tetha 4y ago

Indeed, I've been looking around somewhat during off-time with a colleague how much we actually use of sudo, and what doas couldn't do. We're indeed looking at starting a migration, because some DNS based, LDAP integrated, PAM integrated, really complicated priviledge escalator is becoming kinda scary as of late. The biggest difference we found is that sudo is a little more convenient to manage with a config management solution, since each piece of config management code can just drop a file in /etc/sudoers.d. With doas, we have to coordinate a bunch of parts of the config management manipulating one file, /etc/doas.conf. This always turns out a bit messy. But maybe we'll just merge everything into one big and somewhat messy monster doas-conf-template with a ton of feature toggles and loops and go from there. But beyond that, almost all of our sudo rules are 2-3 patterns: Admin can sudo as everyone, zabbix/telegraf can run data gathering commands, and maybe some other automation triggers like pgbackrest wiping a postgres data dir during a restore, that's about it. All of those are pretty trivial doas rules all in all.

yjftsjthsd-h 4y ago
The biggest difference we found is that sudo is a little more convenient to manage with a config management solution, since each piece of config management code can just drop a file in /etc/sudoers.d. With doas, we have to coordinate a bunch of parts of the config management manipulating one file, /etc/doas.conf. Apparently whether it's used is configured at build time, because I get different results trying it on Arch and Alpine, but doas absolutely has a /etc/doas.d EDIT: Oops, apparently Alpine added that - https://git.alpinelinux.org/aports/tree/main/doas/configuration-directory.patch https://git.alpinelinux.org/aports/tree/main/doas/configurat...
- TheBrokenRail 4y ago
  > EDIT: Oops, apparently Alpine added that This seems like a really weird thing for a distro to add themselves rather than upstream.
  - somat 4y ago
    not really, alpine really wanted it. openbsd did not, it was a simple patch. you are probably going to maintain a patchset anyway(for the port to alpine) might as well maintain one more to support a simple feature you really want.

seanw444 4y ago

Been maining opendoas for a while now. The main problem I have with it is that the "don't require a password for ___ seconds" timeout is unconfigurable as far as I'm aware. So you have to enter your password fairly frequently, which can be annoying on non-sensitive machines. But for simple systems that aren't running complex user privilege management, doas is very much a great replacement.

galangalalgol 4y ago
I don't see any tests on the github. Is there some way to do pipelines for open source projects that wouldn't require funding? Would a free gitlab tier account for stuff like this be within the TOS? I just find it kind of crazy how most of the open source ecosystem has no static analysis or unit tests. I'm not criticizing, I'm trying to figure out how to contribute.
- bornfreddy 4y ago
  Github does allow (some amount of) GH Actions for free, as does Gitlab.
  - dathinab 4y ago
    It does but it's kinda a pain for use for anything but scripting languages in my experience. They way it scales doesn't fit well with C/C++/Rust/Scala/Java/etc. build systems and test runners. I'm also having problems with it at work all the time, like task randomly being reported as canceled after they already passed. Or task after completion hanging for well over 30min until some internal timeout triggers and they then get reported as failure. Or a task being reported as succeeded to the UI and as failed to follow up tasks. (All issues I ran into just in the last week :=(, some might be caused by us having to use local GH Actio runners due to how GH Actions work, but I also have seen all this problems before we started using local runners so probably not).
7839284023 4y ago
> The main problem I have with it is that the "don't require a password for ___ seconds" timeout is unconfigurable as far as I'm aware. https://wiki.archlinux.org/title/Doas#doas_persist_feature https://wiki.archlinux.org/title/Doas#doas_persist_feature https://wiki.gentoo.org/wiki/Doas https://wiki.gentoo.org/wiki/Doas With the persist keyword doas can remember an authenticated user and will not require confirmation by password for five minutes.

ranger_danger 4y ago

kaba0 4y ago
Has absolutely nothing to do with the topic, and frankly, I rather trust a unified program with a set of functionalities done cleanly in a programming language over a set of random bash scripts trying to do the same, but failing. It’s not like you don’t have to communicate between them and it is goddamn bash.. I would make less error in binary.

zokier 4y ago

> It’s also been ported to Linux Last time I checked there were several different ports floating around. Now I see at least Debian has chosen opendoas, I guess people have mostly converged to that one. Also fun stuff like https://π.duncano.de/slicer69-doas.html https://xn--1xa.duncano.de/slicer69-doas.html The point being that while openbsd doas is undoubtedly very nice, the linux ports are separate projects

Veserv 4y ago

To put the relative simplicity into perspective, here is the official Github mirror of sudo: https://github.com/sudo-project/sudo https://github.com/sudo-project/sudo On the contributors tab: https://github.com/sudo-project/sudo/graphs/contributors https://github.com/sudo-project/sudo/graphs/contributors We can see that sudo has been maintained by one person for ~29 years who has single-handedly committed ~2,936,000 changes over that time resulting in a net increase of ~480,000. It is also being actively developed with ~270,000 changes resulting in a net increase of ~40,000 lines in the last twelve months. In contrast doas is, just eyeballing it, maybe ~500 lines and at most 1000 lines all together.

efficax 4y ago
why on earth is sudo so complicated. All I want it to do is: ensure authorization, raise privileges, call exec.
- rob-olmos 4y ago
  Probably because of sudoers?
  - mordechai9000 4y ago
    The documentation describes the configuration as a context free grammar using EBNF notation. This is impressive, but maybe a little more complicated than I want to get with a basic security tool. I suspect most people who don't have to modify it very often are going to secondary sources, like tutorials or stack overflow, and copying examples from there.
    - tgv 4y ago
      IMO, a more complex grammar allows for better descriptions. The only real type of grammar simpler than CFG is a regular expression. That's pretty limited, although (the older part of) CSS doesn't need more than that. But as soon as you want a nested construction, hierarchy or simply nested parentheses, you need a CFG. If it's difficult to configure, the problem is the (configuration) language, not the power of its grammar. And there are excellent parser generators out there. You don't have to fear introducing bugs via them.

thayne 4y ago

It looks like doas is missing some important features sudo has, notably full I/O logging and wildcard and in the newest version regex support for matching arguments. The latter could maybe be worked around with wrapper scripts, but I don't know what you would do for logging. And the password persist option is experimental, and not configurable on Linux. If you don't need those features, doas is probably a good replacement. But if you do, it probably isn't an option.

josteink 4y ago
> It looks like doas is missing some important features sudo has … and wildcard and in the newest version regex support for matching arguments. Sometimes less is more. My immediate response to that is that it sounds like needless complexity which can be a source of errors, bugs and security-vulnerabilities. What typical use-cases do these particular features have?
- ehutch79 4y ago
  For wildcards; Allowing a user to use systemctl with specific daemons, so ```systemctl * unit-name```, without a password. But anything outside of that I need a password.
  - Denvercoder9 4y ago
    It's actually good to not support such things, because it makes it way too easy to give more permissions than you intent to. In your example it effectively gives unlimited root access, as you can do `systemctl edit unit-name` and change the unit to run arbitrary programs as root.
    - claviola 4y ago
      That's all well and true, but it's an expected downside which you'd see with any software which needs to be properly configured to run. If a user doesn't know they should take this seriously by ensuring that a tool which potentially grants root privileges is correctly configured, that shouldn't stop others who know better.

uri4 4y ago

Or just uninstall sudo, at least on opensuse it is optional package.

ilyt 4y ago

As meme as it is, Rust rewrite wouldn't be out of place...

wyldfire 4y ago

> Sudo must be the program with the largest number of buffer overflows I’ve heard about. That news is repeating itself ever since I remember. That you've heard about. There's two big reasons: (1) people often don't try to spend a lot of time finding exploits for userspace programs that don't open network ports or perform privilege escalation. And (2) when they do find exploits in those programs, they don't make it to HN.

still_grokking 4y ago

> Sudo must be the program with the largest number of buffer overflows I’ve heard about. That news is repeating itself ever since I remember. libxml? zlib? PHP? The déjà vs are many…