Re: I will not buy this record, it is scratched

Mihai Moldovan <[email protected]> Tue, 28 Nov 2017 06:30:27 +0100
Newsgroups	gmane.comp.tools.sudo.user
Message-ID	<[email protected]>
* On 11/27/2017 04:34 PM, Todd C. Miller wrote:
> I think it is fair to consider this a bug.  Since sudo switches
> uids and groups around while searching for commands it caches the
> source and target user's group vector so it doesn't need to be
> looked up multiple times.

That sounds reasonable to avoid useless work (especially in more complicated
setups with network-based groups with a lot of users and groups).


> In this case, where the source and target user are the same, sudo
> will use the same group vector it started with.  It should probably
> always look up the target group vector since we want to run the
> command with the groups specified by the group database.

Yes, I would certainly recommend this.
Same-user context are probably special, in the sense that the group vector *can*
be cached - while that's usually not possible for different-user contexts. I
would expect this bug doesn't show up in such a case, since sudo needs to query
either the kernel or higher-level systems to get the target-user groups, either
after authorization successful checks, or before command execution, anyway,
since that information cannot be reasonably cached. This would require using a
system daemon or caching files on-disk. Neither would be a smart idea for sudo
in the first place.


> In sudo 1.8.7 and above you can work around this by adding the
> following line to /etc/sudo.conf (creating the file if it doesn't
> already exist):
> 
> Set group_source dynamic
> 
> That will cause sudo to ignore the existing group vector (the one
> returned by getgroups(2)) and always query the group database
> directly.

Indeed, that works great for my use case! The groups vector is correctly
re-initialized. I must have missed this option while searching around. Then
again, this is a very unusual use case in the first place...

Thanks a bunch.


If possible, please keep this in mind for a future version!



Mihai

____________________________________________________________
sudo-users mailing list <[email protected]>
For list information, options, or to unsubscribe, visit:
https://www.sudo.ws/mailman/listinfo/sudo-users
signature.asc (application/pgp-signature, 898 B)