Re: Are `su user' and/or `sudo -u user sh' considered dangerous?

[Jakub Wilk <jwilk () jwilk net>]

* Georgi Guninski <guninski () guninski com>, 2018-06-12, 13:17:
> https://j.ludost.net/blog/archives/2018/06/12/are_su_user_andor_sudo_-u_user_sh_considered_dangerous/index.html
>
> Per vague memory I discussed half of this with some linux crowd and 
> they said "won't fix" long ago.
>
> `su user' and `sudo -u user sh' give the user the fd of root's tty and 
> it is readable and writable. After closing the session, the user can 
> keep it and on root's tty potentially do:
>
> 1. inject keypresses via ioctl()
> and/or
> 2. read the output of root's tty, probably with some analogue of 
> tee(1).
>
> Is this really a concern?

This class of vulnerabilities has been known since at least 2005:
https://bugzilla.redhat.com/show_bug.cgi?id=173008 (CVE-2005-4890)

It was last discussed on oss-security in 2017:
http://seclists.org/oss-sec/2017/q2/412

> Any workarounds?

For sudo, there's the "use_pty" flag. (It's not enabled by default.)

--
Jakub Wilk