6 ms·
Being a setuid binary means that sudo also suffers from attacks where an attacker runs `sudo ./malware` and then convinces the user to authenticate. Depending
by charcircuit 2y ago
Being a setuid binary means that sudo also suffers from
attacks where an attacker runs `sudo ./malware` and then convinces the user to authenticate. Depending on how sudo authenticates phishing attacks or password reuse from another breach can be used to escalate privileges.
- jvanderbot 2y agoThose will also have to be fixed/considered, but do not detract from the contribution of removing memory safety bugs which may enable exploits.
- charcircuit 2y agoThis is a case of doubling down on bad design. To me it's wasted effort preventing theoretical bugs in niche setups.
- a_t48 2y agoEven with a new, perfect paradigm, there would be billions of systems running sudo for years.
- jvanderbot 2y agoI think the opposing view is that moving away from sudo is substantially more effort and would break basically everything to accomplish "the same" thing as robustifying sudo (for some very loose definition of "same")
- charcircuit 2y agoYes, it's more effort, but it's not close to being the same.
- pixl97 2y agoI mean moving from IPv4 to IPv6 is more effort, but it's not close to being the same... And it's also why it mostly has not happened for most people.
- im3w1l 2y agoI don't think you can realistically enforce a security boundary between root, and a user account that occasionally elevates. You can enforce a boundary between root and an account that never elevates though. And as far as I understand hardening sudo helps with that.
- charcircuit 2y ago>I don't think you can realistically enforce a security boundary between root, and a user account that occasionally elevates. So stop doing that!
- z3t4 2y agoWhat should you do instead?
- charcircuit 2y agoDesign the system so that you do not need users to escalate to root. Find each use case where a user may want to use sudo and then come up with an alternate way to accomplish that action from a regular account.
- lupusreal 2y agoWe have that, it's called android. Anybody who finds themselves using sudo is already well off the beaten path, by their own choice. There's nothing wrong with that.
- charcircuit 2y agoDoing system updates is not off the beaten path.
- theamk 2y agoAnd system updates don't need sudo on desktops, it is not 1990's anymore... GUI apps like software-properties-gtk use dbus with polkit auth to upgrade software without any involvement of "sudo" or giving root access to users.
- hulitu 2y ago> Being a setuid binary means that sudo also suffers from attacks where an attacker runs `sudo ./malware` and then convinces the user to authenticate So does your OS.
- remram 2y agoI don't see how this attack is related to the setuid binary. No matter what method you provide to the user to elevate their privileges, they can be tricked into doing it. If it was provided by a daemon, built into systemd, or anything else, the problem would be the same.
- charcircuit 2y agoIt's related because malicous code can use the setuid binary to elevate its privileges. >If it was provided by a daemon, built into systemd, or anything else Yes, this is also dangerous.
- remram 2y agoSo what's your recommendation? Removing the user?
- zahlman 2y agoDo you have in mind a design that enables users to escalate privileges while preventing them from being tricked into escalating privileges?