Date: Fri, 13 Feb 2015 08:29:32 +0000 From: Simon McVittie <smcv@...ian.org> To: oss-security@...ts.openwall.com Subject: Re: Re: CVE request: sudo TZ issue On 13/02/15 07:05, Rich Felker wrote: > On Wed, Feb 11, 2015 at 10:20:03AM -0700, Todd C. Miller wrote: >> However, there is no real way for the application to tell that it >> is being run by an unpriviliged user and that operations that would >> otherwise be safe (opening a user-specified time zone file) may be >> dangerous. > > Why does sudo run the target program with both effective and real ids > set to root? Why not run with only the effective uid set to root? Firstly, as far as I'm aware, sudo's design is "su, but better" and setting the real uid matches how su works. Secondly, becoming root is not the only reason why you might want to use sudo or su; they can also be used to drop privileges from root to non-root, or switch from one non-root user to another. Under the current design, the target program can't switch back; if the real uid was still that of the original user, it could. Thirdly, if every program and every library is expected to be aware of Unix arcana like "if euid != uid, then the results of getenv() are untrustworthy", then that would effectively put every program invoked via sudo, and every library that they link, into the trusted set. AIUI, part of the point of sudo is that it does the checks and acts as the trust boundary, so that the target program doesn't have to. S
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.