10 ms·

sudo and su Being Rewritten in Rust for Memory Safety

164 points by cf100clunk 4y ago

deepsun 4y ago
Are they going to remove Protobuf from sudo? It's not written in Rust.
- deepsun 4y ago
  Wow, so many downvotes, not sure why. E.g. CVE-2022-33070 is really because sudo uses protobuf-c.
  - tialaramex 4y ago
    I can't figure out what you thought you were getting at, which may be why the downvotes from others? Rust has a perfectly nice protobuf implementation if they want one, why would it become a C dependency for a Rust rewrite?
zh3 4y ago
This seems worthwhile at first sight; another implementation (in a different language) gives us more choice and time will tell on the CVE count:user ratio.
- anthk 4y ago
  Find an error on the Rust runtime and then the whole security collapses down as a house of cards. It's bad to think on security by just using a language.
  - lalaithion 4y ago
    I mean, the same is true with the C runtime.
    - hulitu 4y ago
      > I mean, the same is true with the C runtime. My c compiler does not connect to internet during compiling.
      - some_furry 4y ago
        What do you do if a dependent .so isn't found? Do you not have to install said dependency from the Internet and start (at least part of) the compile over?
      - overthrow 4y ago
        Nor does the Rust compiler. Rust's build system, Cargo, does however. And many C build systems do as well, e.g. https://cmake.org/cmake/help/latest/guide/using-dependencies/index.html#downloading-and-building-from-source-with-fetchcontent https://cmake.org/cmake/help/latest/guide/using-dependencies...
        steveklabnik 4y ago
        Optionally. Cargo doesn’t have to connect to the internet, and even has command line switches to fail if it tries to.
        hulitu 4y ago
        Good to know.
        hulitu 4y ago
        Thank you for the tip. I shall do ifconfig eth0 down before compiling to avoid such issues.
    - ittan 4y ago
      Isn't "C Runtime" inaccurate? Wouldn't it be the static or dynamic linked libraries for the particular program in question?
      - 4y ago
  - smt88 4y ago
    No one is saying they should switch languages and stop all other security work.
  - hulitu 4y ago
    No need for errors. Just a compromised package on crates.io. It's funny how rust is praised as secure without any code audit.
    - iknowstuff 4y ago
      Yeah your single header libs from pastebin get so many audits by comparison. https://github.com/RustSec/rustsec/tree/main/cargo-audit https://github.com/RustSec/rustsec/tree/main/cargo-audit https://mozilla.github.io/cargo-vet/ https://mozilla.github.io/cargo-vet/ Besides, every dependency is locked.
    - haswell 4y ago
      Security means many things, and supply chain vulnerabilities are just one of many factors to evaluate when considering languages. Rust improves or eliminates some issues, but that does not imply that other issues are magically solved.
    - fnordpiglet 4y ago
      I don’t think people generally say secure, they say safe. Safe is necessary but insufficient for secure. The existing implementations assume safety by diligence. Rust promises safety by construction. That’s useful. But, to your point, insufficient. People that say secure when they mean safe are just wrong.
  - MattPalmer1086 4y ago
    Rust doesn't have a runtime. Nobody is suggesting that a language solves all security issues. It does have much better memory safety than C, which is the cause of the majority of security issues.
    - duped 4y ago
      Rust has a minimal runtime (0), and links to libc by default which brings in the libc runtime (so it's not like C is any better). Except that the Rust runtime is written in Rust, which is nice for memory safety. (0) https://prev.rust-lang.org/en-US/faq.html#does-rust-have-a-runtime https://prev.rust-lang.org/en-US/faq.html#does-rust-have-a-r...
      - MattPalmer1086 4y ago
        Well, opinions in the Rust community clearly differ: "Rust is blazingly fast and memory-efficient: with no runtime or garbage collector" [0] I guess it depends on what you mean by a runtime. Panic handlers and initialisation code is a pretty small runtime. [0] https://www.rust-lang.org/ https://www.rust-lang.org/
  - samus 4y ago
    Even if there are error, the impact of each error would not be higher than if it occurred in libc or any other language runtime.
- 3a2d29 4y ago
  Yeah agree with this, will be interesting to see. I assume the more unsafe rust used, the more the CVE numbers will appear like C and C++. People like to say unsafe means "I checked this and this is fine, compiler" and isn't a bad thing but I feel that's inaccurate since the whole point of rust is that people struggle to write safe code even when they are really checking. I feel unsafe rust is way more "I really hope this is right, but I have minimized it to just this area out of necessity, since it likely isn't." I would like to see how much CVEs go down over time. The fact sudo is being rewritten suggests that even after long periods of use, security issues popping up is still a common-ish problem?
  - arp242 4y ago
    > security issues popping up is still a common-ish problem? It seems to average out at a bit over 1 per year over the last 20 years, based on [1]; is that "a lot"? I guess? It's worth pointing out that while there certainly are memory-related C-style issues, quite a few are logic errors because all of this is rather subtle once you start adding features beyond what e.g. "doas" does. For example the recent "Sudoedit can edit arbitrary files"[2] is a somewhat subtle interaction between sudoedit, environment variables, and flag parsing. Previously there was [3] and [4] from 2004 and 2010. Will memory safety be a benefit? Of course it will. But I think these kind of issues are the real challenge here. A drop-in replacement for "sudo" is useful, but I have to wonder if it wouldn't be better to rethink the approach from first principles, taking 40 years of sudo lessons in to account. It's also surprisingly easy to shoot yourself in the foot with a wrong sudoers file, which is not strictly a security issue in sudo as such but also something that can probably be improved on? That 2023 sudoedit bug has been in sudo since 1.8, released in 2011, and Todd has been maintaining sudo since 1994, and he's actually pretty good as well as experienced with this kind of stuff. Yet he still missed it, as did everyone else, for well over ten years. It seems there are far more structural problems in the entire approach that go well beyond "C is not memory safe". That's certainly an issue, but in a way seems almost banal compared to the deeper issues. [1]: https://www.sudo.ws/security/advisories/ https://www.sudo.ws/security/advisories/ [2]: https://www.sudo.ws/security/advisories/sudoedit_any/ https://www.sudo.ws/security/advisories/sudoedit_any/ [3]: https://www.sudo.ws/security/advisories/sudoedit_escalate2/ https://www.sudo.ws/security/advisories/sudoedit_escalate2/ [4]: https://www.sudo.ws/security/advisories/sudoedit/ https://www.sudo.ws/security/advisories/sudoedit/
- ChancyChance 4y ago
  How would I find the CVE's on sudo/su? I opened up mitre.org and cve.org, but searches for sudo/su brought up hundreds of issues (or more), and most of them were not about sudo/su. (It's a bit like searching for "The The"'s music on early Google.)
  - arp242 4y ago
    There's [1], which I think is comprehensive from 2001 up to today. [1]: https://www.sudo.ws/security/advisories/ https://www.sudo.ws/security/advisories/
capableweb 4y ago
Why not create a new program with a different name instead of rewriting it? It's a new program at that point anyway. Edit: seems the article confused me with the word rewriting when the source homepage and repository says reimplemention, which makes more sense.
- cf100clunk 4y ago
  I see what you mean, but there is further muddying of the waters as Prossimo themselves use the term "rewriting" here: https://www.memorysafety.org/initiative/sudo-su/ https://www.memorysafety.org/initiative/sudo-su/
- ChancyChance 4y ago
  Because then you end up with multiple versions of a critical tool, which drift out of sync, and create more vulnerabilities. (e.g., look at the bluetooth/hci interface on linux.)
  - capableweb 4y ago
    Compared to rewriting something which never reintroduces issues rust been fixed in the past?
anthk 4y ago
Ah, yes; rewrite everything in Rust before switching to doas/opendoas.
- cf100clunk 4y ago
  ... and then reimplement opendoas in Rust.
- PrimeMcFly 4y ago
  Numerous systems use sudo/su, there's tons of scripts that reply on them etc. Having a more secure version of these base tools is still a good idea, even if we should be switching to doas instead/slower than is ideal.
- arp242 4y ago
  sudo offers many more features than doas. That's doas' strength, and why I use it myself, but it also means you can't use it in more complex use cases. It's a drop-in replacement perhaps 95% of the time or thereabouts, but for the remaining 5% sudo is your only option AFAIK.
PeterWhittaker 4y ago
Related discussions: https://news.ycombinator.com/item?id=35714347 https://news.ycombinator.com/item?id=35714347 https://news.ycombinator.com/item?id=35740863 https://news.ycombinator.com/item?id=35740863
- dang 4y ago
  Thanks! Macroexpanded: sudo-rs: A memory safe implementation of sudo and su - https://news.ycombinator.com/item?id=35740863 https://news.ycombinator.com/item?id=35740863 - April 2023 (8 comments) Bringing Memory Safety to sudo and su - https://news.ycombinator.com/item?id=35714347 https://news.ycombinator.com/item?id=35714347 - April 2023 (80 comments)
  - cf100clunk 4y ago
    OP here, sorry dang I actually used the Algolia search tool before posting but hadn't had enough coffee beforehand to be alert to those.
    - dang 4y ago
      No worries!
Snetry 4y ago
I know some people have said that sudo should be rewritten in rust but why su?
- hannob 4y ago
  Well, it's also a suid binary, thus it's very safety critical on unix-systems. su isn't as complex as sudo, so there's less reason to create a "simpler su", but still, a memory safe su seems like a good idea. And given su and sudo provide similar functionality, doing them together likely creates synergies and code that can be shared.
  - lamontcg 4y ago
    And su has to be setuid root and is pretty much mandatory and if you can exploit a bug in it you've got local privilege escalation. I don't know selinux/apparmor well but I imagine su is granted the permission to create root shells, because of course it does, so any exploit will punch through all that as well.
jackmott 4y ago
Sudo had a root exploit recently that wasn’t memory safety related, but the rust sun types would have prevented that too. They remove any urge to use sigils (ie negative 1 or 0 mean something special) which you can forget to check. Its easier and nicer to use rust sun types and they don’t let you forget.
- bitwize 4y ago
  But do the sun types implement the Star trait?
- chmod600 4y ago
  What's a "sun" type? Do you mean "sum" type? And sigils are symbols, not special values: https://en.m.wikipedia.org/wiki/Sigil_(computer_programming) https://en.m.wikipedia.org/wiki/Sigil_(computer_programming)
  - jrockway 4y ago
    Probably typos for sum and sentinel.
guenthert 4y ago
I laud the effort and I understand that rust gets a lot of visibility here on HN, but when the motivation is to improve security, than why not use a language which goes through great length of ensuring such, e.g. the SPARK subset of Ada?
- awestroke 4y ago
  Because they are not as good of a fit. Rust strikes an extremely good balance between memory safety and productivity. Also almost nobody knows Ada, and even fewer the flavor you mentioned
  - taylodl 4y ago
    Are we concerned with memory safety and security or popularity?
    - tardibear 4y ago
      Maintainability is the other issue.
    - pcwalton 4y ago
      Both SPARK and Rust provide memory safety, so it's perfectly reasonable to use popularity as a "tie breaker". Applications are written by people; the more people who can usefully contribute, the more work can be done.
      - 0xfedbee 4y ago
        What’s your source saying more people write Rust than Ada? There are people outside HN.
        anp 4y ago
        The TIOBE index’s[0] methodology is definitely flawed but it currently lists Rust at 19 and Ada at 22. No mention of SPARK. [0] https://www.tiobe.com/tiobe-index/ https://www.tiobe.com/tiobe-index/
Galicarnax 4y ago
Are there real-life examples where "traditional non-safe" sudo/su lead to problems?
- mustache_kimono 4y ago
  Plenty. See: https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=sudo https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=sudo Double free, just this year: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-27320 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-2732... Use after free: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0493 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0493 Recent buffer overflows: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3156 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3156, https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18634 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1863... Buffer over-read: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-43995 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-4399...
binjooou 4y ago
A 1000 line long dependency file full of random literally whos code doing god knows what does not instill alot of confidence when I want to build and audit security critical programs.
- baq 4y ago
  You don’t need cargo to write software in Rust
- Pengtuzi 4y ago
  You seem to be off by a factor of 100 unless I’m missing something? [workspace.dependencies] clap = "4.0.32" libc = "0.2.139" thiserror = "1.0.38" glob = "0.3.1" sha2 = "0.10.6" digest = "0.10.6" signal-hook = "0.3.15" log = "0.4.17" syslog = "6.0.1" env_logger = "0.9.3"
  - akira2501 4y ago
    And what dependencies do those dependencies have?
    - deleted 4y ago
      [deleted]
    - deleted 4y ago
      [deleted]
    - deleted 4y ago
      [deleted]
    - AnIrishDuck 4y ago
      It transitively expands out to 47 unique packages? Still doesn't seem that crazy to me: $ cargo tree -e no-build --prefix none | sort | uniq | grep -v sudo | grep -v '\*' aho-corasick v0.7.20 atty v0.2.14 bitflags v1.3.2 block-buffer v0.10.4 cfg-if v1.0.0 clap_builder v4.1.14 clap_derive v4.1.14 (proc-macro) clap_lex v0.4.0 clap v4.1.14 cpufeatures v0.2.6 crypto-common v0.1.6 digest v0.10.6 env_logger v0.9.3 error-chain v0.12.4 generic-array v0.14.7 glob v0.3.1 heck v0.4.1 hostname v0.3.1 humantime v2.1.0 io-lifetimes v1.0.9 is-terminal v0.4.5 itoa v1.0.6 libc v0.2.140 linux-raw-sys v0.1.4 log v0.4.17 match_cfg v0.1.0 memchr v2.5.0 num_threads v0.1.6 once_cell v1.17.1 proc-macro2 v1.0.54 quote v1.0.26 regex-syntax v0.6.29 regex v1.7.3 rustix v0.36.11 sha2 v0.10.6 signal-hook-registry v1.4.1 signal-hook v0.3.15 strsim v0.10.0 syn v2.0.11 syslog v6.0.1 termcolor v1.2.0 thiserror-impl v1.0.40 (proc-macro) thiserror v1.0.40 time-core v0.1.0 time v0.3.20 typenum v1.16.0 unicode-ident v1.0.8
meindnoch 4y ago
Why does it have so many dependencies?
- KirillPanov 4y ago
  ... and how many of those use `unsafe { }`?
  - logicprog 4y ago
    This betrays a fundamental misunderstanding of how Rust and unsafe work. You sometimes need to use unsafe Rust for low level work or C/C++ FFI; that doesn't make the rest of your code unsafe as long as you A) use it only when necessary and B) ensure that the basic invariants are maintained and the basic contract between safe and unsafe code is upheld. This whole "well it uses unsafe in parts so its suddenly all unsafe and we might as well use C" thing is a bit silly.
- logicprog 4y ago
  People unfamiliar with Rust constantly ask this question and the answer is always the same: because they're not reinventing the wheel and rolling their own cryptography, hash functions, etc. The more you do that, instead of using battle-tested existing libraries with plenty of maintainers, the more likely it is that you'll introduce a security vulnerability. Plus it duplicates effort unnecessarily, when it would be better to pool it. For context, if anyone's curious, here's the dependency list: clap = "4.0.32" libc = "0.2.139" thiserror = "1.0.38" glob = "0.3.1" sha2 = "0.10.6" digest = "0.10.6" signal-hook = "0.3.15" log = "0.4.17" syslog = "6.0.1" env_logger = "0.9.3"
markhahn 4y ago
how many of us had never even heard of sudoedit? I rarely see anyone using sudo features other than "run this with root". given that sudo's security history has mostly non-memory-corruption/overflow faults, the big win would be refining/simplifying it, regardless of language.
- dvzk 4y ago
  sudoedit and visudo are mandatory on a host machine given the tendency for sudoers parse failures. Defaults env_keep = "" ? Oops, I guess sudo no longer works.
deleted 4y ago
[deleted]
Patrickmi 4y ago
Is it only me or ….. when there’s a big news about a certain programming language within 2 days open source projects begin to pop up like they’re the main story
pxeger1 4y ago
I think it will be interesting to see how the memory safety gains from using Rust trade off against the potential logic bugs created by a full rewrite. (Or maybe there won't be any - I guess they can probably reuse the tests from the original?)
- Sugimot0 4y ago
  I know uutils/core-utils uses the old tests, which makes sense, that way you cover most of the intentional behavior. A more comprehensive method could be to generate a comprehensive set of random scripts with a capable LLM like GPT4 in identical vm's with the 2 different binaries and then log/diff each scripts behavior.
Luker88 4y ago
Good effort, and while I usually would like to see more GPL software, at least Apache2+MIT looks better than the little mess in sudo licensing: https://www.sudo.ws/sudo/license.html https://www.sudo.ws/sudo/license.html just a nitpick on their milestone4: https://www.memorysafety.org/initiative/sudo-su/sudo-su-work-plan/ https://www.memorysafety.org/initiative/sudo-su/sudo-su-work... I understand mail capabilities, but LDAP/Kerberos direct integration? Why is PAM considered bad here? That looks like a duplication of maintenance points in user/group management
- Nullabillity 4y ago
  PAM is included in milestone 1.
xarthna 4y ago
Why not port https://github.com/Duncaen/OpenDoas https://github.com/Duncaen/OpenDoas to rust instead? If the goal is security, then there is more to it than just using a memory safe language. Otherwise the result of this, possibly unwittingly, seems performative.

164 points by cf100clunk 4y ago

deepsun 4y ago

Are they going to remove Protobuf from sudo? It's not written in Rust.

deepsun 4y ago
Wow, so many downvotes, not sure why. E.g. CVE-2022-33070 is really because sudo uses protobuf-c.
- tialaramex 4y ago
  I can't figure out what you thought you were getting at, which may be why the downvotes from others? Rust has a perfectly nice protobuf implementation if they want one, why would it become a C dependency for a Rust rewrite?

zh3 4y ago

This seems worthwhile at first sight; another implementation (in a different language) gives us more choice and time will tell on the CVE count:user ratio.

anthk 4y ago
Find an error on the Rust runtime and then the whole security collapses down as a house of cards. It's bad to think on security by just using a language.
- lalaithion 4y ago
  I mean, the same is true with the C runtime.
  - hulitu 4y ago
    > I mean, the same is true with the C runtime. My c compiler does not connect to internet during compiling.
    - some_furry 4y ago
      What do you do if a dependent .so isn't found? Do you not have to install said dependency from the Internet and start (at least part of) the compile over?
    - overthrow 4y ago
      Nor does the Rust compiler. Rust's build system, Cargo, does however. And many C build systems do as well, e.g. https://cmake.org/cmake/help/latest/guide/using-dependencies/index.html#downloading-and-building-from-source-with-fetchcontent https://cmake.org/cmake/help/latest/guide/using-dependencies...
      - steveklabnik 4y ago
        Optionally. Cargo doesn’t have to connect to the internet, and even has command line switches to fail if it tries to.
        hulitu 4y ago
        Good to know.
      - hulitu 4y ago
        Thank you for the tip. I shall do ifconfig eth0 down before compiling to avoid such issues.
  - ittan 4y ago
    Isn't "C Runtime" inaccurate? Wouldn't it be the static or dynamic linked libraries for the particular program in question?
    - 4y ago
- smt88 4y ago
  No one is saying they should switch languages and stop all other security work.
- hulitu 4y ago
  No need for errors. Just a compromised package on crates.io. It's funny how rust is praised as secure without any code audit.
  - iknowstuff 4y ago
    Yeah your single header libs from pastebin get so many audits by comparison. https://github.com/RustSec/rustsec/tree/main/cargo-audit https://github.com/RustSec/rustsec/tree/main/cargo-audit https://mozilla.github.io/cargo-vet/ https://mozilla.github.io/cargo-vet/ Besides, every dependency is locked.
  - haswell 4y ago
    Security means many things, and supply chain vulnerabilities are just one of many factors to evaluate when considering languages. Rust improves or eliminates some issues, but that does not imply that other issues are magically solved.
  - fnordpiglet 4y ago
    I don’t think people generally say secure, they say safe. Safe is necessary but insufficient for secure. The existing implementations assume safety by diligence. Rust promises safety by construction. That’s useful. But, to your point, insufficient. People that say secure when they mean safe are just wrong.
- MattPalmer1086 4y ago
  Rust doesn't have a runtime. Nobody is suggesting that a language solves all security issues. It does have much better memory safety than C, which is the cause of the majority of security issues.
  - duped 4y ago
    Rust has a minimal runtime (0), and links to libc by default which brings in the libc runtime (so it's not like C is any better). Except that the Rust runtime is written in Rust, which is nice for memory safety. (0) https://prev.rust-lang.org/en-US/faq.html#does-rust-have-a-runtime https://prev.rust-lang.org/en-US/faq.html#does-rust-have-a-r...
    - MattPalmer1086 4y ago
      Well, opinions in the Rust community clearly differ: "Rust is blazingly fast and memory-efficient: with no runtime or garbage collector" [0] I guess it depends on what you mean by a runtime. Panic handlers and initialisation code is a pretty small runtime. [0] https://www.rust-lang.org/ https://www.rust-lang.org/
- samus 4y ago
  Even if there are error, the impact of each error would not be higher than if it occurred in libc or any other language runtime.
3a2d29 4y ago
Yeah agree with this, will be interesting to see. I assume the more unsafe rust used, the more the CVE numbers will appear like C and C++. People like to say unsafe means "I checked this and this is fine, compiler" and isn't a bad thing but I feel that's inaccurate since the whole point of rust is that people struggle to write safe code even when they are really checking. I feel unsafe rust is way more "I really hope this is right, but I have minimized it to just this area out of necessity, since it likely isn't." I would like to see how much CVEs go down over time. The fact sudo is being rewritten suggests that even after long periods of use, security issues popping up is still a common-ish problem?
- arp242 4y ago
  > security issues popping up is still a common-ish problem? It seems to average out at a bit over 1 per year over the last 20 years, based on [1]; is that "a lot"? I guess? It's worth pointing out that while there certainly are memory-related C-style issues, quite a few are logic errors because all of this is rather subtle once you start adding features beyond what e.g. "doas" does. For example the recent "Sudoedit can edit arbitrary files"[2] is a somewhat subtle interaction between sudoedit, environment variables, and flag parsing. Previously there was [3] and [4] from 2004 and 2010. Will memory safety be a benefit? Of course it will. But I think these kind of issues are the real challenge here. A drop-in replacement for "sudo" is useful, but I have to wonder if it wouldn't be better to rethink the approach from first principles, taking 40 years of sudo lessons in to account. It's also surprisingly easy to shoot yourself in the foot with a wrong sudoers file, which is not strictly a security issue in sudo as such but also something that can probably be improved on? That 2023 sudoedit bug has been in sudo since 1.8, released in 2011, and Todd has been maintaining sudo since 1994, and he's actually pretty good as well as experienced with this kind of stuff. Yet he still missed it, as did everyone else, for well over ten years. It seems there are far more structural problems in the entire approach that go well beyond "C is not memory safe". That's certainly an issue, but in a way seems almost banal compared to the deeper issues. [1]: https://www.sudo.ws/security/advisories/ https://www.sudo.ws/security/advisories/ [2]: https://www.sudo.ws/security/advisories/sudoedit_any/ https://www.sudo.ws/security/advisories/sudoedit_any/ [3]: https://www.sudo.ws/security/advisories/sudoedit_escalate2/ https://www.sudo.ws/security/advisories/sudoedit_escalate2/ [4]: https://www.sudo.ws/security/advisories/sudoedit/ https://www.sudo.ws/security/advisories/sudoedit/
ChancyChance 4y ago
How would I find the CVE's on sudo/su? I opened up mitre.org and cve.org, but searches for sudo/su brought up hundreds of issues (or more), and most of them were not about sudo/su. (It's a bit like searching for "The The"'s music on early Google.)
- arp242 4y ago
  There's [1], which I think is comprehensive from 2001 up to today. [1]: https://www.sudo.ws/security/advisories/ https://www.sudo.ws/security/advisories/

capableweb 4y ago

Why not create a new program with a different name instead of rewriting it? It's a new program at that point anyway. Edit: seems the article confused me with the word rewriting when the source homepage and repository says reimplemention, which makes more sense.

cf100clunk 4y ago
I see what you mean, but there is further muddying of the waters as Prossimo themselves use the term "rewriting" here: https://www.memorysafety.org/initiative/sudo-su/ https://www.memorysafety.org/initiative/sudo-su/
ChancyChance 4y ago
Because then you end up with multiple versions of a critical tool, which drift out of sync, and create more vulnerabilities. (e.g., look at the bluetooth/hci interface on linux.)
- capableweb 4y ago
  Compared to rewriting something which never reintroduces issues rust been fixed in the past?

anthk 4y ago

Ah, yes; rewrite everything in Rust before switching to doas/opendoas.

cf100clunk 4y ago
... and then reimplement opendoas in Rust.
PrimeMcFly 4y ago
Numerous systems use sudo/su, there's tons of scripts that reply on them etc. Having a more secure version of these base tools is still a good idea, even if we should be switching to doas instead/slower than is ideal.
arp242 4y ago
sudo offers many more features than doas. That's doas' strength, and why I use it myself, but it also means you can't use it in more complex use cases. It's a drop-in replacement perhaps 95% of the time or thereabouts, but for the remaining 5% sudo is your only option AFAIK.

PeterWhittaker 4y ago

Related discussions: https://news.ycombinator.com/item?id=35714347 https://news.ycombinator.com/item?id=35714347 https://news.ycombinator.com/item?id=35740863 https://news.ycombinator.com/item?id=35740863

dang 4y ago
Thanks! Macroexpanded: sudo-rs: A memory safe implementation of sudo and su - https://news.ycombinator.com/item?id=35740863 https://news.ycombinator.com/item?id=35740863 - April 2023 (8 comments) Bringing Memory Safety to sudo and su - https://news.ycombinator.com/item?id=35714347 https://news.ycombinator.com/item?id=35714347 - April 2023 (80 comments)
- cf100clunk 4y ago
  OP here, sorry dang I actually used the Algolia search tool before posting but hadn't had enough coffee beforehand to be alert to those.
  - dang 4y ago
    No worries!

Snetry 4y ago

I know some people have said that sudo should be rewritten in rust but why su?

hannob 4y ago
Well, it's also a suid binary, thus it's very safety critical on unix-systems. su isn't as complex as sudo, so there's less reason to create a "simpler su", but still, a memory safe su seems like a good idea. And given su and sudo provide similar functionality, doing them together likely creates synergies and code that can be shared.
- lamontcg 4y ago
  And su has to be setuid root and is pretty much mandatory and if you can exploit a bug in it you've got local privilege escalation. I don't know selinux/apparmor well but I imagine su is granted the permission to create root shells, because of course it does, so any exploit will punch through all that as well.

jackmott 4y ago

Sudo had a root exploit recently that wasn’t memory safety related, but the rust sun types would have prevented that too. They remove any urge to use sigils (ie negative 1 or 0 mean something special) which you can forget to check. Its easier and nicer to use rust sun types and they don’t let you forget.

bitwize 4y ago
But do the sun types implement the Star trait?
chmod600 4y ago
What's a "sun" type? Do you mean "sum" type? And sigils are symbols, not special values: https://en.m.wikipedia.org/wiki/Sigil_(computer_programming) https://en.m.wikipedia.org/wiki/Sigil_(computer_programming)
- jrockway 4y ago
  Probably typos for sum and sentinel.

guenthert 4y ago

I laud the effort and I understand that rust gets a lot of visibility here on HN, but when the motivation is to improve security, than why not use a language which goes through great length of ensuring such, e.g. the SPARK subset of Ada?

awestroke 4y ago
Because they are not as good of a fit. Rust strikes an extremely good balance between memory safety and productivity. Also almost nobody knows Ada, and even fewer the flavor you mentioned
- taylodl 4y ago
  Are we concerned with memory safety and security or popularity?
  - tardibear 4y ago
    Maintainability is the other issue.
  - pcwalton 4y ago
    Both SPARK and Rust provide memory safety, so it's perfectly reasonable to use popularity as a "tie breaker". Applications are written by people; the more people who can usefully contribute, the more work can be done.
    - 0xfedbee 4y ago
      What’s your source saying more people write Rust than Ada? There are people outside HN.
      - anp 4y ago
        The TIOBE index’s[0] methodology is definitely flawed but it currently lists Rust at 19 and Ada at 22. No mention of SPARK. [0] https://www.tiobe.com/tiobe-index/ https://www.tiobe.com/tiobe-index/

Galicarnax 4y ago

Are there real-life examples where "traditional non-safe" sudo/su lead to problems?

mustache_kimono 4y ago
Plenty. See: https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=sudo https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=sudo Double free, just this year: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-27320 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-2732... Use after free: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0493 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0493 Recent buffer overflows: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3156 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3156, https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18634 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1863... Buffer over-read: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-43995 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-4399...

binjooou 4y ago

A 1000 line long dependency file full of random literally whos code doing god knows what does not instill alot of confidence when I want to build and audit security critical programs.

baq 4y ago
You don’t need cargo to write software in Rust
Pengtuzi 4y ago
You seem to be off by a factor of 100 unless I’m missing something? [workspace.dependencies] clap = "4.0.32" libc = "0.2.139" thiserror = "1.0.38" glob = "0.3.1" sha2 = "0.10.6" digest = "0.10.6" signal-hook = "0.3.15" log = "0.4.17" syslog = "6.0.1" env_logger = "0.9.3"
- akira2501 4y ago
  And what dependencies do those dependencies have?
  - deleted 4y ago
    [deleted]
  - deleted 4y ago
    [deleted]
  - deleted 4y ago
    [deleted]
  - AnIrishDuck 4y ago
    It transitively expands out to 47 unique packages? Still doesn't seem that crazy to me: $ cargo tree -e no-build --prefix none | sort | uniq | grep -v sudo | grep -v '\*' aho-corasick v0.7.20 atty v0.2.14 bitflags v1.3.2 block-buffer v0.10.4 cfg-if v1.0.0 clap_builder v4.1.14 clap_derive v4.1.14 (proc-macro) clap_lex v0.4.0 clap v4.1.14 cpufeatures v0.2.6 crypto-common v0.1.6 digest v0.10.6 env_logger v0.9.3 error-chain v0.12.4 generic-array v0.14.7 glob v0.3.1 heck v0.4.1 hostname v0.3.1 humantime v2.1.0 io-lifetimes v1.0.9 is-terminal v0.4.5 itoa v1.0.6 libc v0.2.140 linux-raw-sys v0.1.4 log v0.4.17 match_cfg v0.1.0 memchr v2.5.0 num_threads v0.1.6 once_cell v1.17.1 proc-macro2 v1.0.54 quote v1.0.26 regex-syntax v0.6.29 regex v1.7.3 rustix v0.36.11 sha2 v0.10.6 signal-hook-registry v1.4.1 signal-hook v0.3.15 strsim v0.10.0 syn v2.0.11 syslog v6.0.1 termcolor v1.2.0 thiserror-impl v1.0.40 (proc-macro) thiserror v1.0.40 time-core v0.1.0 time v0.3.20 typenum v1.16.0 unicode-ident v1.0.8

meindnoch 4y ago

Why does it have so many dependencies?

KirillPanov 4y ago
... and how many of those use `unsafe { }`?
- logicprog 4y ago
  This betrays a fundamental misunderstanding of how Rust and unsafe work. You sometimes need to use unsafe Rust for low level work or C/C++ FFI; that doesn't make the rest of your code unsafe as long as you A) use it only when necessary and B) ensure that the basic invariants are maintained and the basic contract between safe and unsafe code is upheld. This whole "well it uses unsafe in parts so its suddenly all unsafe and we might as well use C" thing is a bit silly.
logicprog 4y ago
People unfamiliar with Rust constantly ask this question and the answer is always the same: because they're not reinventing the wheel and rolling their own cryptography, hash functions, etc. The more you do that, instead of using battle-tested existing libraries with plenty of maintainers, the more likely it is that you'll introduce a security vulnerability. Plus it duplicates effort unnecessarily, when it would be better to pool it. For context, if anyone's curious, here's the dependency list: clap = "4.0.32" libc = "0.2.139" thiserror = "1.0.38" glob = "0.3.1" sha2 = "0.10.6" digest = "0.10.6" signal-hook = "0.3.15" log = "0.4.17" syslog = "6.0.1" env_logger = "0.9.3"

markhahn 4y ago

how many of us had never even heard of sudoedit? I rarely see anyone using sudo features other than "run this with root". given that sudo's security history has mostly non-memory-corruption/overflow faults, the big win would be refining/simplifying it, regardless of language.

dvzk 4y ago
sudoedit and visudo are mandatory on a host machine given the tendency for sudoers parse failures. Defaults env_keep = "" ? Oops, I guess sudo no longer works.

deleted 4y ago

[deleted]

Patrickmi 4y ago

Is it only me or ….. when there’s a big news about a certain programming language within 2 days open source projects begin to pop up like they’re the main story

pxeger1 4y ago

I think it will be interesting to see how the memory safety gains from using Rust trade off against the potential logic bugs created by a full rewrite. (Or maybe there won't be any - I guess they can probably reuse the tests from the original?)

Sugimot0 4y ago
I know uutils/core-utils uses the old tests, which makes sense, that way you cover most of the intentional behavior. A more comprehensive method could be to generate a comprehensive set of random scripts with a capable LLM like GPT4 in identical vm's with the 2 different binaries and then log/diff each scripts behavior.

Luker88 4y ago

Good effort, and while I usually would like to see more GPL software, at least Apache2+MIT looks better than the little mess in sudo licensing: https://www.sudo.ws/sudo/license.html https://www.sudo.ws/sudo/license.html just a nitpick on their milestone4: https://www.memorysafety.org/initiative/sudo-su/sudo-su-work-plan/ https://www.memorysafety.org/initiative/sudo-su/sudo-su-work... I understand mail capabilities, but LDAP/Kerberos direct integration? Why is PAM considered bad here? That looks like a duplication of maintenance points in user/group management

Nullabillity 4y ago
PAM is included in milestone 1.

xarthna 4y ago

Why not port https://github.com/Duncaen/OpenDoas https://github.com/Duncaen/OpenDoas to rust instead? If the goal is security, then there is more to it than just using a memory safe language. Otherwise the result of this, possibly unwittingly, seems performative.