Re: Question/Suggestion about not automatically forwarding sudo permissions to scripts.

On Mon, 31 Jul 2017 16:00:48 +0200, Matthias Aechtner wrote:

> When I execute a script without `sudo`, then I do not want the script to
> have any root privileges. However, when the script itself contains lines
> starting with `sudo`, these commands will be executed with root
> privileges without asking for password.
> 
> I am wondering if it would be possible to allow `sudo` commands to
> execute without reentering the password only in the current interactive
> shell, but not to forward the permission to run with `sudo` into scripts
> that are executed.

By default, sudo will allow additional commands to be run from the
same terminal for five minutes.  When a terminal is not available,
it uses the parent process ID instead (typically the shell's process
ID).  This is not currently exposed as a configurable option but
it could be without much effort.  I think that would make sudo
behave the way you want.

> In my case I downloaded a script from the internet and I was willing to
> risk running it unseen with user privileges on my computer, and was
> shocked when I saw the script executing with root privileges (even so I
> ran it without `sudo`, just because I had run `sudo` in the same session
> before). IMHO this behavior exposes a security risk that should, if
> possible, eliminated in future versions of `sudo`.

I'm sorry but running an arbitrary script from the internet is the
real security issue here.  Even if sudo wasn't able to run without
a password, the script would still have access to your terminal and
any files writable by your user ID.  A nefarious program would be
capable of stealing passwords or trojaning your shell startup files.

That said, I'm not opposed to adding a sudoers option to use the
parent pid instad of the tty name to differentiate between timestamp
records.  I've written a proof of concept diff that appears to
work as expected.

 - todd
____________________________________________________________
sudo-workers mailing list <[email protected]>
For list information, options, or to unsubscribe, visit:
https://www.sudo.ws/mailman/listinfo/sudo-workers