oss-sec mailing list archives
Re: Re: CVE request: sudo TZ issue
From: "Todd C. Miller" <Todd.Miller () courtesan com>
Date: Fri, 13 Feb 2015 06:28:37 -0700
On Fri, 13 Feb 2015 02:05:05 -0500, Rich Felker wrote:
Why does sudo run the target program with both effective and real ids set to root? Why not run with only the effective uid set to root? Then the program would know that it's being run by an unprivileged user with elevated privileges (and its libc would restrict or ignore environment variables for internal libc use). Does such invocation break too many programs?
Unfortunately running setuid can result in undesirable behavior with some programs, especially those that are already setuid. For example, things like "sudo passwd" or "sudo crontab" would no longer work. Sudo does have a "stay_setuid" setting that will run programs with the user's real uid but it is not widely used. - todd
Current thread:
- CVE request: sudo TZ issue Todd C. Miller (Feb 09)
- <Possible follow-ups>
- Re: CVE request: sudo TZ issue Florian Weimer (Feb 10)
- Re: CVE request: sudo TZ issue Todd C. Miller (Feb 10)
- Re: CVE request: sudo TZ issue cve-assign (Feb 10)
- Re: Re: CVE request: sudo TZ issue Florian Weimer (Feb 11)
- Re: CVE request: sudo TZ issue cve-assign (Feb 12)
- Re: Re: CVE request: sudo TZ issue Todd C. Miller (Feb 11)
- Re: Re: CVE request: sudo TZ issue Rich Felker (Feb 12)
- Re: Re: CVE request: sudo TZ issue Simon McVittie (Feb 13)
- Re: Re: CVE request: sudo TZ issue Todd C. Miller (Feb 13)