Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Memory-safe sudo to become the default in Ubuntu

trifectatech.org

Post reply on HN
Print view View original

161–170 of 282 posts

Re: Memory-safe sudo to become the default in Ubuntu

#161

Post by passivegains »

Spivak wrote: post #143
bArray wrote: post #121

> This move is part of a broader effort by Canonical to improve the resilience and maintainability of core system components. Sudo-rs is developed by the Trifecta Tech Foundation (TTF), a nonprofit organization that creates secure, open source building blocks for infrastructure software. Ubuntu continuously updates itself without permission, killing apps and losing previous state. You have the Javascript based Gnome…

> Ubuntu continuously updates itself without permission, killing apps and losing previous state. What? Is this some snap thing because apt sure as hell doesn't do this without you configuring it explicitly.

apt won't on its own, but if you're using the official images there's probably a service running that's calling it, probably for security patches etc.

The bigger problem is upgrading packages deliberately but being surprised by the results. My team's current favorite is the upgrade process itself suddenly having new interactive prompts breaking our scripts.

Re: Memory-safe sudo to become the default in Ubuntu

#162

Post by zahlman »

charcircuit wrote: post #27
MajesticHobo2 wrote: post #16

Earlier quoted context omitted.

Right, but now the vector for privilege escalation will have to be a logic bug in memory-safe sudo instead of either a memory corruption (see CVE-2021-3156) or a logic bug. It’s hard not to see this as a major improvement.

Being a setuid binary means that sudo also suffers from attacks where an attacker runs `sudo ./malware` and then convinces the user to authenticate. Depending on how sudo authenticates phishing attacks or password reuse from another breach can be used to escalate privileges.

Do you have in mind a design that enables users to escalate privileges while preventing them from being tricked into escalating privileges?

Re: Memory-safe sudo to become the default in Ubuntu

#163

Post by Ygg2 »

ziddoap wrote: post #154
Ygg2 wrote: post #151

Earlier quoted context omitted.

> The proselytizing is the religious element, not the act of rewriting tools in Rust. Ok. Where is the proselytizing taking place in the article? Is the sudo-rs did work, the proselytization? Where is it? > The meme "Rust Evangelists" didn't manifest out of thin air That's not how memes work. It's just something that appeals to some group that spreads it. It can be true, false and fabricated out of thin air. What if…

> Ok. Where is the proselytizing taking place in the article? It's not? It's like you're picking random words out of my comment to quote without bothering to read what I'm writing. Nothing of what I said is about the article. It's about your misinterpretation of what fossuser meant when they said "religious element". I can't explain the same thing for a third (fourth, I guess? since I just tried again) time, I'm runn…

> It's about your misinterpretation of what fossuser meant when they said "religious element".

My point, where is the proof of that "religious element" beyond memes? Is it in the article? Is it in the links? Where can we see this religious fervor in action?

The article is very matter of fact. I expect people to be matter of fact as well.

I swear to God, I feel like I'm asking for the Individualist Eleven book, and everyone asserts me it exists, and they read it, but no one can ever finds it.

> Your meta-commentary on memes is neat and all, but again, somehow, completely misses the point I was making.

It's necessary because memes aren't real. They might have started based on some interactions that 10 years ago, but by their nature they will mutate and twist.

Re: Memory-safe sudo to become the default in Ubuntu

#164

Post by Dylan16807 »

0cf8612b2e1e wrote: post #138
Dylan16807 wrote: post #26

Earlier quoted context omitted.

"without a rewrite" means cutting down the existing code. A completely different program goes into the same category as "rewrite".

doas is 500 lines of C. Two orders is magnitude less than sudo yet still covers the core functionality. Sure you could grandfather”s axe your way into the final product, but difficult to see how a a hypothetical code base 1% of the original counted as anything but a rewrite.

Your phrasing sounds like you disagree with me, but you're saying the same thing, right? That doas is not an example of "without a rewrite".

Re: Memory-safe sudo to become the default in Ubuntu

#165

Post by zahlman »

charcircuit wrote: post #87
z3t4 wrote: post #75

Earlier quoted context omitted.

What should you do instead?

Design the system so that you do not need users to escalate to root. Find each use case where a user may want to use sudo and then come up with an alternate way to accomplish that action from a regular account.

Currently, for any given action, the following possibilities are implemented:

* The user may never perform the action (would require sudo, but the user doesn't have sudo rights)

* The user may sometimes perform the action (i.e. only after authenticating with sudo)

* The user may always perform the action (is always implicitly authenticated)

"Being root" is just another name for the last option.

What fourth alternative do you have in mind?

Re: Memory-safe sudo to become the default in Ubuntu

#166

Post by rzzzt »

wkat4242 wrote: post #124
bArray wrote: post #121

> This move is part of a broader effort by Canonical to improve the resilience and maintainability of core system components. Sudo-rs is developed by the Trifecta Tech Foundation (TTF), a nonprofit organization that creates secure, open source building blocks for infrastructure software. Ubuntu continuously updates itself without permission, killing apps and losing previous state. You have the Javascript based Gnome…

I think you mean a magic bullet instead of a smoking gun :)

Fish in a barrel!

Re: Memory-safe sudo to become the default in Ubuntu

#167

Post by charcircuit »

msm_ wrote: post #79
charcircuit wrote: post #71

Earlier quoted context omitted.

>I don't think you can realistically enforce a security boundary between root, and a user account that occasionally elevates. So stop doing that!

Who are you shouting at? Going back to the topic of the discussion, making sudo more resilient prevents a whole class of possible bugs (see CVE-2021-3156). You may not like sudo, but it is very commonly used to manage access, prevent accidental errors, or improve accountability on Linux servers and workstations. It is not going away. Therefore, improving sudo is a worthwhile goal and a thing to be celebrated.

I'm not shouting.

>sudo more resilient prevents a whole class of possible bugs

Good, but this doesn't fix the easiest way to escalate privileges as an attacker through sudo. Memory safety doesn't help people who run "curl | sudo bash" to install a random program from the internet.

>It is not going away.

But if work is done it could become very niche and eventually stop getting new usage over time.

Re: Memory-safe sudo to become the default in Ubuntu

#168

Post by ziddoap »

Ygg2 wrote: post #163
ziddoap wrote: post #154

Earlier quoted context omitted.

> Ok. Where is the proselytizing taking place in the article? It's not? It's like you're picking random words out of my comment to quote without bothering to read what I'm writing. Nothing of what I said is about the article. It's about your misinterpretation of what fossuser meant when they said "religious element". I can't explain the same thing for a third (fourth, I guess? since I just tried again) time, I'm runn…

> It's about your misinterpretation of what fossuser meant when they said "religious element". My point, where is the proof of that "religious element" beyond memes? Is it in the article? Is it in the links? Where can we see this religious fervor in action? The article is very matter of fact. I expect people to be matter of fact as well. I swear to God, I feel like I'm asking for the Individualist Eleven book, and ev…

>My point, where is the proof of that "religious element" beyond memes? Is it in the article? Is it in the links? Where can we see this religious fervor in action?

You can argue with fossuser about the validity of what they said.

I'll offer my opinion, which is not some proof from god or anything that you seem to be seeking, which is that I find significantly more annoying comments from Rust users, about how something should be rewritten in Rust to fix everything, than any other language. But, again, this is not proof from god. I'm just a guy making an observation based on my lived experience. You have a different lived experience. Glad we could clear that up.

Re: Memory-safe sudo to become the default in Ubuntu

#169

Post by zahlman »

tialaramex wrote: post #61
homefree wrote: post #11

Earlier quoted context omitted.

[flagged]

Politics is just everything. "No politics" usually means, "Opinions which conflict with mine are unwelcome" or at best the small-C conservative idea that the status quo has existed forever and so whatever happens to presently be the case is just how things should be. In your own comment you mention "actually the best outcome" but that's a matter of politics, doubtless you have different ideas about what "best" would…

> Politics is just everything.

The point is that they seem to have conflated opinions about what policies are correct for general real-world issues, with those that are specific to the task of programming.

> "No politics" usually means

No; "no politics" usually means "please do not attempt to bring up topics that relate to decisions made by governments, and instead stay focused on topics directly related to the project at hand".

> or at best the small-C conservative idea that the status quo has existed forever and so whatever happens to presently be the case is just how things should be.

I have never understood how this argument makes sense to anyone. Obviously, "changing the status quo" is a policy position in a way that "not changing the status quo" isn't. The argument is effectively that it's impossible to just not care about something, for any given thing. I refute this by noting that an effectively unlimited number of policies can be proposed, yet I am not constantly thinking about politics.

> but that's a matter of politics, doubtless you have different ideas about what "best" would be than I do, and I appreciate that perhaps you've never considered that anybody other than you could be right, but you might want to take a moment to think again.

Again, I can't fathom how this line of argument makes sense to anyone. "Politics" is, quite simply, understood by the overwhelming majority of people in such a way that determining "best outcome" for a computer program not used in any government capacity is obviously not a political matter.

Or else: in your view, what does "should `sudo` do X in Y situation?" have in common with "should country X go to war with country Y?" ?

Re: Memory-safe sudo to become the default in Ubuntu

#170

Post by watermelon0 »

nottorp wrote: post #155
bArray wrote: post #121

> This move is part of a broader effort by Canonical to improve the resilience and maintainability of core system components. Sudo-rs is developed by the Trifecta Tech Foundation (TTF), a nonprofit organization that creates secure, open source building blocks for infrastructure software. Ubuntu continuously updates itself without permission, killing apps and losing previous state. You have the Javascript based Gnome…

I have the hardware for a new home server waiting to be set up (as in, I don't need a new home server i'm just messing around, so once in a while i log in and configure one more service). I tried the latest Ubuntu and it seems to be targeted at either containers or desktops. Everything I wanted to set up networking wise was a pain for my little non standard configuration. Ended up wiping it and installing Debian inst…

Worth mentioning that many packages on Ubuntu are only available via snap, which includes docker-cli, so they cannot be used inside containers.
Post reply on HN