Potential bypass of Runas user restrictions in sudo
1–10 of 29 posts
Re: Potential bypass of Runas user restrictions in sudo
#2This seems pretty serious, but I wonder if there is a way to measure how many systems are affected by this. Does anyone have telemetry on how many Runas configs are set up this way? How would someone collect this data?
Re: Potential bypass of Runas user restrictions in sudo
#3Interesting bug; I wonder what else might be affected by setuid(-1). That said, I’d hope this bug doesn’t really affect too many systems - letting someone run commands as any non-root user is pretty hazardous because some users have really high privileges (e.g. any user in the “docker” group is functionally equivalent to root if Docker is installed).
I do love that this command has its own website - and a delightfully on-point XKCD-inspired logo :)
Re: Potential bypass of Runas user restrictions in sudo
#4This seems pretty serious, but I wonder if there is a way to measure how many systems are affected by this. Does anyone have telemetry on how many Runas configs are set up this way? How would someone collect this data?
In my experience not many people are aware of the permission model of sudo and I expect a lot of users are merely granted root access. At the same time those deployments which do use sudo's permission model are likely high cost.
Re: Potential bypass of Runas user restrictions in sudo
#5Re: Potential bypass of Runas user restrictions in sudo
#6Are the examples in the advisory statement slightly incorrect? The first example seems to have the user name and host reversed:
myhost alice = (ALL) /usr/bin/id
alice myhost = (ALL) /usr/bin/id
alice ALL = (ALL) /usr/bin/id
As I consider whether this bug impacts my company, I see two types of rules in our sudoers files: (1) rules that let already-privileged users do privileged things and (2) rules that let processes with minimal privileges make an exception to normal security rules. This bug doesn't impact rules for highly privileged users because they already have many ways to do whatever they want. This bug doesn't impact the second type of rules either because those rules specify exactly which user to change to; I tested the '-u#-1' trick with one of those rules on an unpatched sudo and sudo didn't allow it.
The behavior I observed seems to match the advisory, which says the exploitable rules are those that don't specify a specific user to run as.
Now I wonder: what kind of well-written rule would be exploitable?
Re: Potential bypass of Runas user restrictions in sudo
#7The fix was done in https://www.sudo.ws/repos/sudo/rev/83db8dba09e7
The fix appears to be to reject -1 as invalid.
The article should have included in the fix section a link to the commit and a summary of what the fix was.
Re: Potential bypass of Runas user restrictions in sudo
#8Is this the official sudo repository?
https://www.sudo.ws/repos/sudo/file/f75f786eddd5
It has more than 10 thousand commits, ~600 files, and close to 11MB of C code. Also, the code seems to have no unit tests, the main file is 1.4K lines long, has quintuple-nested conditionals and liberally uses goto statements.
Am I missing something here?
Re: Potential bypass of Runas user restrictions in sudo
#9Is this the official sudo repository? https://www.sudo.ws/repos/sudo/file/f75f786eddd5 It has more than 10 thousand commits, ~600 files, and close to 11MB of C code. Also, the code seems to have no unit tests, the main file is 1.4K lines long, has quintuple-nested conditionals and liberally uses goto statements. Am I missing something here?
Some of the points you raise are matters of style (I have files that are 10k lines long and think they are better that way; also I don't think unit tests are as useful as claimed), but yeah, when you have 600 files and 11MB of code to do something that is supposed to be simple and also is security-critical ... you have a big problem.
Re: Potential bypass of Runas user restrictions in sudo
#10Is this the official sudo repository? https://www.sudo.ws/repos/sudo/file/f75f786eddd5 It has more than 10 thousand commits, ~600 files, and close to 11MB of C code. Also, the code seems to have no unit tests, the main file is 1.4K lines long, has quintuple-nested conditionals and liberally uses goto statements. Am I missing something here?
[deleted]