Re: Re: CVE request: sudo TZ issue

[Simon McVittie <smcv () debian org>]

On 13/02/15 07:05, Rich Felker wrote:
> On Wed, Feb 11, 2015 at 10:20:03AM -0700, Todd C. Miller wrote:
> > However, there is no real way for the application to tell that it
> > is being run by an unpriviliged user and that operations that would
> > otherwise be safe (opening a user-specified time zone file) may be
> > dangerous.
>
> Why does sudo run the target program with both effective and real ids
> set to root? Why not run with only the effective uid set to root?

Firstly, as far as I'm aware, sudo's design is "su, but better" and
setting the real uid matches how su works.

Secondly, becoming root is not the only reason why you might want to use
sudo or su; they can also be used to drop privileges from root to
non-root, or switch from one non-root user to another. Under the current
design, the target program can't switch back; if the real uid was still
that of the original user, it could.

Thirdly, if every program and every library is expected to be aware of
Unix arcana like "if euid != uid, then the results of getenv() are
untrustworthy", then that would effectively put every program invoked
via sudo, and every library that they link, into the trusted set. AIUI,
part of the point of sudo is that it does the checks and acts as the
trust boundary, so that the target program doesn't have to.

    S