3 ms·
sudo -k resets the "needs a password to be entered" flag by changing the last-password-entered time to appear to be the UNIX epoch (time 0). If you then change
by mpyne 14y ago
sudo -k resets the "needs a password to be entered" flag by changing the last-password-entered time to appear to be the UNIX epoch (time 0).
If you then change the date to be the same day (which can be done without root permissions in modern Linux distros by using polkit or similar things), then you can use sudo to run commands as root without a password.
Presumably, sudo checks the 'last-successful-login' entry alone before deciding whether to require a password. It ends up thinking you've previously successfully logged in even if you've never actually typed in the needed password.
- derekp7 14y agoSo there are two ways I can see to fix this. Either make setting the time always requires a password, or, add a signal that time-sensitive processes can listen to that gets tripped whenever time is altered.
- ScottBurson 14y agoThere's a much simpler fix that is local to sudo. Sudo has to make the decision of whether to require a password. Just change the line that says something like: if (current_time - last_password_time > INTERVAL) require_password(); to if (last_password_time == 0 || current_time - last_password_time > INTERVAL) require_password();