Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Memory-safe sudo to become the default in Ubuntu

trifectatech.org

Post reply on HN
Print view View original

201–210 of 282 posts

Re: Memory-safe sudo to become the default in Ubuntu

#201

Post by yjftsjthsd-h »

passivegains wrote: post #179
ffsm8 wrote: post #147

Earlier quoted context omitted.

Uh, didn't I say exactly that? Gnu/Linux Is just collegially known as "Linux" and the operation system suffix made it clear what he was talking about. I didn't come up with the usage of the term, I was merely trying to interpret their words.

there's competing specs, holy wars, etc. but POSIX is kind of like what you're describing. popular distros are usually mostly-but-not-completely compliant.

There was also the https://en.wikipedia.org/wiki/Linux_Standard_Base , but unfortunately it wasn't particularly successful.

Re: Memory-safe sudo to become the default in Ubuntu

#202

Post by TacticalCoder »

bArray wrote: post #140
wkat4242 wrote: post #124

Earlier quoted context omitted.

I think you mean a magic bullet instead of a smoking gun :)

I meant "smoking gun" from a cyber security perspective, i.e. the conclusion or the final part of the investigation. "magic bullet" would also work here too though.

[dead]

Re: Memory-safe sudo to become the default in Ubuntu

#203

Post by kokada »

Retr0id wrote: post #15
kokada wrote: post #10

I am not sure if memory-safety is the biggest issue in sudo design. I find the fact that it is a setuid binary a much bigger issue because a bug can possible result in privilege escalation. I found an alternative implementation that doesn't rely in being a setuid binary like systemd-run0 much more interesting from a security perspective, but I am no security expert.

A bug in a daemon-based sudo alternative would surely also result in privilege escalation? I think the main benefit of eliminating setuid binaries is that you can forbid them system-wide (e.g. via mount flags), as a hardening measure.

I think this post explains why much better than I can: https://mastodon.social/@pid_eins/112353324518585654.

So yes, I am not saying that privilege escalation bugs are impossible if you have a different architecture, but like Lennart argues is that it makes them much more difficult to happen, especially because creating a proper setuid is difficult. Also there is a bunch of things that makes sudo especially tricky to implement correctly.

Re: Memory-safe sudo to become the default in Ubuntu

#204

Post by IshKebab »

reissbaker wrote: post #189
IshKebab wrote: post #180

Earlier quoted context omitted.

Why not? The way Windows does it should work in theory I think? Maybe you can't realistically do it on Linux , because Linux doesn't care about desktop security and doesn't have the kind of privileged GUI that you need.

The way Windows does it is users are prompted to elevate permissions, and can be tricked into clicking "Yes," just like users can be tricked into using sudo.

Well yeah you can't enforce any security boundary if your threat model includes "user might be tricked".

It can't be enforced on Linux because `sudo` can be trivially MitM'd, but you can't do that on Windows because it's just a click.

Re: Memory-safe sudo to become the default in Ubuntu

#205

Post by ziddoap »

Ygg2 wrote: post #191
ziddoap wrote: post #168

Earlier quoted context omitted.

> My point, where is the proof of that "religious element" beyond memes? Is it in the article? Is it in the links? Where can we see this religious fervor in action? You can argue with fossuser about the validity of what they said. I'll offer my opinion , which is not some proof from god or anything that you seem to be seeking, which is that I find significantly more annoying comments from Rust users, about how someth…

> which is not some proof from god or anything that you seem to be seeking You know what, you or anyone else can start with actual proofs. I don't want your lived experience and memes as proof, I need messages, posts from people (bonus points for sudo-rs members) that show how zealous they are about Rust and rewriting all the things in it. I'm a Java dev, that just dabbles in Rust. I've seen observed many claims abou…

https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...

Have fun.

(I'm sure if I pick any specific quotes, you'll start arguing the semantics of what is "zealous", how whatever number of comments I pick are outliers, or not proof enough, etc. So, here's one query, of many, that you can pick through.)

In the end, I really could not care less if you agree with the characterization or not. But your enthusiastic defense is fun. If you keep going, you'll be coming close to being an example yourself!

Re: Memory-safe sudo to become the default in Ubuntu

#206

Post by nailer »

steveklabnik wrote: post #195
nailer wrote: post #186

Earlier quoted context omitted.

It's all sides of government. Edit: all links now fixed. ____ (generated, but with references) # U.S. government guidance on memory-safe languages Here's the list of links to U.S. government documents recommending memory-safe programming languages for cybersecurity. 1. *White House ONCD - "Back to the Building Blocks" (Feb 2024)* - Encourages developers to use memory-safe languages like Rust, Python, Java, C#, Go, Sw…

What your parent is referring to is that three of those links now 404. Some of that is simply because whitehouse.gov gets redone with new administrations, and so old stuff is thrown out. They're also referring to how the Trump admin is talking about seriously reducing CISA's budget. Things like that.

All the links are now fixed and return OK now. I don't think Whitehouse data archival is what the parent was referring to.

Re: Memory-safe sudo to become the default in Ubuntu

#207

Post by remram »

charcircuit wrote: post #176
remram wrote: post #142

Earlier quoted context omitted.

I don't see how this attack is related to the setuid binary. No matter what method you provide to the user to elevate their privileges, they can be tricked into doing it. If it was provided by a daemon, built into systemd, or anything else, the problem would be the same.

It's related because malicous code can use the setuid binary to elevate its privileges. >If it was provided by a daemon, built into systemd, or anything else Yes, this is also dangerous.

So what's your recommendation? Removing the user?

Re: Memory-safe sudo to become the default in Ubuntu

#208

Post by homefree »

atoav wrote: post #68
homefree wrote: post #11

Earlier quoted context omitted.

[flagged]

The comment you responded to says: "Seems odd that they don't advertise it [the usage of Rust], though." Isn't not advertising a language the polar opposite of being religious about a language? I am all for a memory safe sudo and I don't care which language it is written in, use C, Ada, Rust, as long as it is a suitable systems programming language understood by a community of developers and you can proof memory safe…

I don't have a strong opinion on what language - the bit you edited in what I was replying to changed the meaning of what they were saying.

My reply is flagged dead now which is fine since it did create an unproductive thread, but it was more that I had noticed Rust as a community seems to have more of an identity based political bent around it more so than other languages. Something I've also noticed with Mozilla - it's not just the language, but that the language signals you're a certain kind of person with a certain kind of politics in addition to the general pro-rust stuff.

I don't recall seeing this combination elsewhere with other languages before - though there have been religious like battles over languages forever, but I don't think it's been predictive of someone's political identity before?

Re: Memory-safe sudo to become the default in Ubuntu

#209

Post by b112 »

mustache_kimono wrote: post #160
bArray wrote: post #121

> This move is part of a broader effort by Canonical to improve the resilience and maintainability of core system components. Sudo-rs is developed by the Trifecta Tech Foundation (TTF), a nonprofit organization that creates secure, open source building blocks for infrastructure software. Ubuntu continuously updates itself without permission, killing apps and losing previous state. You have the Javascript based Gnome…

> That all said, Rust is not a smoking gun for incorrect application logic. It could still happily incorrectly execute stuff with the wrong permissions or blow something up badly. This side steps the issue which is "Does Rust help you make software more correct?" No one is arguing that Rust is perfect. There are plenty of bugs in my Rust software. The question is only -- are we better off with Rust than the alternati…

Linux wants to lay claim to "the Rust kernel"

Entirely untrue. It may happen, but there is zero consensus to port Linux to rust. Not even the tiniest bit.

Re: Memory-safe sudo to become the default in Ubuntu

#210

Post by b112 »

yjftsjthsd-h wrote: post #196
passivegains wrote: post #161

Earlier quoted context omitted.

apt won't on its own, but if you're using the official images there's probably a service running that's calling it, probably for security patches etc. The bigger problem is upgrading packages deliberately but being surprised by the results. My team's current favorite is the upgrade process itself suddenly having new interactive prompts breaking our scripts.

I thought DEBIAN_FRONTEND=noninteractive was supposed to avoid that?

That and a couple of -o's, like conf old (not sure, on my phone)
Post reply on HN