3 ms·

The "suid" and "sudo" terms are not the conventional meanings, which to my mind sensationalizes this list, which is otherwise useful. Real "sudo" has "noexec"

The "suid" and "sudo" terms are not the conventional meanings, which to my mind sensationalizes this list, which is otherwise useful. Real "sudo" has "noexec" which (mostly) prevents issues by way of .so injection to override libc exec() functions (see the "awk" sudo issue for example). setuid/setgid are not to be used lightly, the problem isn't with the program if an admin overrides the permissions it gets. This used to be one of the first things I'd run hardening a linux system: find / -type f -a \( \( -user root -a -perm +4000 \) -o \( -group root -a -perm +6000 \) \)

zokier 3y ago
> Real "sudo" has "noexec" which (mostly) prevents issues by way of .so injection to override libc exec() functions LD_PRELOAD hacks are ugly though.. seccomp filter would be nicer, but apparently you can't really block execve with seccomp. Best thing I found was to ptrace the child, and inject seccomp policies after startup. That is not exactly pretty either, but what other options are there that would also work with static executables? This whole lkml thread is bit depressing, not because the responses are wrong or bad, but because of the hodge-podge nature of unix prevents any easy solutions to fairly reasonable feature request https://lore.kernel.org/all/202010281500.855B950FE@keescook/T/ https://lore.kernel.org/all/202010281500.855B950FE@keescook/...
- zokier 3y ago
  > Best thing I found was to ptrace the child, and inject seccomp policies after startup huh, apparently according to sudo manual that is exactly what sudo NOEXEC does
- jart 3y ago
  You're both half right. The trick is to use LD_PRELOAD to inject a SECCOMP filter. Then you can block execve(). See https://justine.lol/pledge/ https://justine.lol/pledge/ and https://github.com/jart/cosmopolitan/blob/master/tool/build/dso/sandbox.c https://github.com/jart/cosmopolitan/blob/master/tool/build/...
  - nathants 3y ago
    this, or custom lsm modules so they’re harder to turn off.

zokier 3y ago

> Real "sudo" has "noexec" which (mostly) prevents issues by way of .so injection to override libc exec() functions LD_PRELOAD hacks are ugly though.. seccomp filter would be nicer, but apparently you can't really block execve with seccomp. Best thing I found was to ptrace the child, and inject seccomp policies after startup. That is not exactly pretty either, but what other options are there that would also work with static executables? This whole lkml thread is bit depressing, not because the responses are wrong or bad, but because of the hodge-podge nature of unix prevents any easy solutions to fairly reasonable feature request https://lore.kernel.org/all/202010281500.855B950FE@keescook/T/ https://lore.kernel.org/all/202010281500.855B950FE@keescook/...

zokier 3y ago
> Best thing I found was to ptrace the child, and inject seccomp policies after startup huh, apparently according to sudo manual that is exactly what sudo NOEXEC does
jart 3y ago
You're both half right. The trick is to use LD_PRELOAD to inject a SECCOMP filter. Then you can block execve(). See https://justine.lol/pledge/ https://justine.lol/pledge/ and https://github.com/jart/cosmopolitan/blob/master/tool/build/dso/sandbox.c https://github.com/jart/cosmopolitan/blob/master/tool/build/...
- nathants 3y ago
  this, or custom lsm modules so they’re harder to turn off.