8 ms·

sudo-rs: A memory safe implementation of sudo and su

9 points by voxadam 4y ago

detaro 4y ago
dupe https://news.ycombinator.com/item?id=35714347 https://news.ycombinator.com/item?id=35714347
KMnO4 4y ago
Is the regular version of sudo really riddled with memory safety concerns? Historically there have been few and far between security vulnerabilities. I’m not convinced that rewriting something in rust makes it automatically safer.
- nibbleshifter 4y ago
  About one decently exploitable bug a year or so over the past few years. Not all of them have been memory safety issues, but many have been.
- Tobu 4y ago
  https://www.cvedetails.com/vulnerability-search.php?f=1&product=sudo https://www.cvedetails.com/vulnerability-search.php?f=1&prod... finds quite a few: double free, array out of bounds, buffer overflows in the stack and the heap… There's also a format string vulnerability that wouldn't exist in Rust and which C turns into privilege escalation instead of aborting.
UI_at_80x24 4y ago
Wasn't that already solved with 'doas'?
- vermaden 4y ago
  Yes - and with better results I think :) doas(1) - doas(1) - portable version has about 500 lines of code - doas(1) man pages - 157 lines long - doas(1) had 2 CVEs sudo(8) - sudo(8) - about 120,000 lines of code (100x more) - sudo(8) man pages - 10 000 lines long - sudo(8) had 140 CVEs The CVEs comparison is from 'all time' and as sudo(8) has longer history then doas(1) - it will (at least statistically) have more of these ... I expect doas(1) to have about 5-10 CVEs when they would have the same life span. Regards, vermaden
  - UI_at_80x24 4y ago
    Holy shit, yer famous and replied to me! </end fanboy-mode> Seriously, your contributions are priceless; Your blogs are helpful and inspirational. Thank-you so much for your contributions.
netsec_burn 4y ago
Trading one class of vulnerabilities for another. Memory corruption bugs for logic bugs. The disclaimer on the README is correct, this is not secure. From a five minute cursory review I identified that you can enumerate file paths in directories that you don't have privileges to view (prior to sudo-rs authenticating you via PAM).
- rnijveld 4y ago
  We’d love to get a report for this! While we are sure we will make bugs (which is also why we have the notice up on the repository, and you have to go through some hoops in order to use it), we also think that we can try and come up with an implementation that is safer in other ways as well. And if nothing else then at least some good attention will hopefully be drawn to sudo, because it can use a little care and attention.
vermaden 4y ago
I would rename it to suro(8) instead of sudo(8) :>

9 points by voxadam 4y ago

dupe https://news.ycombinator.com/item?id=35714347 https://news.ycombinator.com/item?id=35714347

Is the regular version of sudo really riddled with memory safety concerns? Historically there have been few and far between security vulnerabilities. I’m not convinced that rewriting something in rust makes it automatically safer.

nibbleshifter 4y ago
About one decently exploitable bug a year or so over the past few years. Not all of them have been memory safety issues, but many have been.
Tobu 4y ago
https://www.cvedetails.com/vulnerability-search.php?f=1&product=sudo https://www.cvedetails.com/vulnerability-search.php?f=1&prod... finds quite a few: double free, array out of bounds, buffer overflows in the stack and the heap… There's also a format string vulnerability that wouldn't exist in Rust and which C turns into privilege escalation instead of aborting.

UI_at_80x24 4y ago

Wasn't that already solved with 'doas'?

vermaden 4y ago
Yes - and with better results I think :) doas(1) - doas(1) - portable version has about 500 lines of code - doas(1) man pages - 157 lines long - doas(1) had 2 CVEs sudo(8) - sudo(8) - about 120,000 lines of code (100x more) - sudo(8) man pages - 10 000 lines long - sudo(8) had 140 CVEs The CVEs comparison is from 'all time' and as sudo(8) has longer history then doas(1) - it will (at least statistically) have more of these ... I expect doas(1) to have about 5-10 CVEs when they would have the same life span. Regards, vermaden
- UI_at_80x24 4y ago
  Holy shit, yer famous and replied to me! </end fanboy-mode> Seriously, your contributions are priceless; Your blogs are helpful and inspirational. Thank-you so much for your contributions.

netsec_burn 4y ago

Trading one class of vulnerabilities for another. Memory corruption bugs for logic bugs. The disclaimer on the README is correct, this is not secure. From a five minute cursory review I identified that you can enumerate file paths in directories that you don't have privileges to view (prior to sudo-rs authenticating you via PAM).

rnijveld 4y ago
We’d love to get a report for this! While we are sure we will make bugs (which is also why we have the notice up on the repository, and you have to go through some hoops in order to use it), we also think that we can try and come up with an implementation that is safer in other ways as well. And if nothing else then at least some good attention will hopefully be drawn to sudo, because it can use a little care and attention.

vermaden 4y ago

I would rename it to suro(8) instead of sudo(8) :>