I moved to https://man.openbsd.org/doas long ago.
Sudoedit can edit arbitrary files
11–20 of 61 posts
Re: Sudoedit can edit arbitrary files
#12Why is this a problem, given that one can easily use sudoedit for privilege escalation already? edit: I now realize I have confused sudoedit with visudo
Read the link instead of replying based on the title.
Re: Sudoedit can edit arbitrary files
#13I wonder if this bug in logic (instead of buffer overflows) would also have been less likely in a different language. Would it have been more obvious in a language where it's easier to work with dynamically allocated arrays and strings?
Looking at the patch[1], probably not. There isn't really a lot of complex string handling involved; it's basically just forgetting to forbid "--". I don't really see how any language choice could help you with this.
[1]: https://github.com/sudo-project/sudo/commit/0274a4f3b403162a...
Re: Sudoedit can edit arbitrary files
#14Why would one prefer to add sudoedit X to sudoers rather than updating file access privileges of X directly?
Just curious about arguments for this use case.
Re: Sudoedit can edit arbitrary files
#15I find it handy that most distros have a CVE look-up 'service':
* https://security-tracker.debian.org/tracker/CVE-2023-22809
* https://ubuntu.com/security/CVE-2023-22809
* https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2023-22809
Debian has links to the others.
Re: Sudoedit can edit arbitrary files
#16Does this really work? The command is supposed to copy the original file to a temporary file, run the edit command with the privileges of the original user and then copy the edited file over the original. Otherwise what’s stopping an attacker from telling the editor to just open another file?
Re: Sudoedit can edit arbitrary files
#17Why would one prefer to add sudoedit X to sudoers rather than updating file access privileges of X directly? Just curious about arguments for this use case.
> Why would one prefer to add sudoedit X to sudoers rather than updating file access privileges of X directly?
Permission complications.
Software may run as user:group, but you don't want to add humans to either, and so you allow them to edit a few files as that user or group from their own account (which also gives you auditing of changes). Some software insists on files (directories) have certain permissions so you're stuff with them.
Or you want a centralized place for permissions, so you put these sudoedit entries in LDAP which can be accessed anywhere in you network, and so you don't have to keep track of individual file permissions on a gazillion systems.
Re: Sudoedit can edit arbitrary files
#18Why would one prefer to add sudoedit X to sudoers rather than updating file access privileges of X directly? Just curious about arguments for this use case.
Sudo basically has an ACL-like system where you can specify exactly which users/groups can execute which commands as root. So you can say user foo can execute commands X, Y, and Z as root and user bar can execute commands W, Y, and Z as root, and neither user can use sudo to execute any other command as root. The ACL system isn't for sudoedit specifically, it's a general feature of sudo.
As to why you can't just update access privileges of the file, for most use cases you probably could do that. If you need something more complicated though you'll have to use some terrible ACL implementation like the one in sudo or Posix file ACLs.
Re: Sudoedit can edit arbitrary files
#19Does this really work? The command is supposed to copy the original file to a temporary file, run the edit command with the privileges of the original user and then copy the edited file over the original. Otherwise what’s stopping an attacker from telling the editor to just open another file?
You're correct but sudoedit itself needs to parse the file list to know which files to copy to temporary files as you describe. So in this case you're tricking sudoedit into thinking you want to edit a different file than the one specified originally on the command line.
Re: Sudoedit can edit arbitrary files
#20Does this really work? The command is supposed to copy the original file to a temporary file, run the edit command with the privileges of the original user and then copy the edited file over the original. Otherwise what’s stopping an attacker from telling the editor to just open another file?
Yeah I had the same confusion, the linked PDF explains it. Basically sudo determines the list of files to edit after expanding the `EDITOR` variable into separate arguments, and the `--` in the argument list (added by `sudo`) is used to determine where the file arguments provided to `sudoedit` start in the new argument list.
By adding your own `--` in the `EDITOR` variable, `sudo` gets confused and thinks that `--` is the start of the `sudoedit` file arguments and thus happily copies and edits all the files after it.