Bug 100332 - security/sudo: suboptimal sudo configuration
Summary: security/sudo: suboptimal sudo configuration
Status: Closed FIXED
Alias: None
Product: Ports & Packages
Classification: Unclassified
Component: Individual Port(s) (show other bugs)
Version: Latest
Hardware: Any Any
: Normal Affects Only Me
Assignee: Stefan Walter
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2006-07-15 10:10 UTC by Dr. Markus Waldeck
Modified: 2007-04-14 15:13 UTC (History)
0 users

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Dr. Markus Waldeck 2006-07-15 10:10:16 UTC
According to the CHANGES file (#432) in the sudo source code "env_reset" is
normally default!

sudo -V shows that there is no "Reset the environment to a default set of
variables", but only "Ignore '.' in $PATH".

This is NOT sufficient and will fail in following test case (see "How to
repeat").

Fix: 

Use the default "env_reset" instead of "ignore_dot"!
How-To-Repeat: % echo 'echo BULLSHIT' > date
% chmod +x date
% date
% export PATH=.:$PATH
% date
% sudo date
% sudo sh
# date
Comment 1 Edwin Groothuis freebsd_committer freebsd_triage 2006-07-15 11:51:49 UTC
Responsible Changed
From-To: freebsd-ports-bugs->mharo

Over to maintainer
Comment 2 Mark Linimon freebsd_committer freebsd_triage 2007-03-23 09:51:21 UTC
Responsible Changed
From-To: mharo->freebsd-ports-bugs

Maintainer was reset.
Comment 3 Stefan Walter freebsd_committer freebsd_triage 2007-04-04 08:54:54 UTC
Responsible Changed
From-To: freebsd-ports-bugs->stefan

Take.
Comment 4 Stefan Walter freebsd_committer freebsd_triage 2007-04-04 09:14:56 UTC
Hi,

I had a brief look at what sudo does and found the following:

- As mentioned in CHANGES in the sudo distribution, 'env_reset' is a
  so-called 'Defaults' option. That doesn't mean it's on by default,
  though - see the section 'Defaults' in sudoers(5) how it's turned on.
- A quick test showed that even with 'env_reset' enabled sudo does not
  modify my $PATH, so your example still works. (The environment is
  stripped to basic variables, though.) I think that's either a bug in
  sudo itself or in the man page, depending on how you look at it. (It
  says that only $TERM is copied unaltered from the old environment, but
  looking at the source code, $PATH is only touched/replaced if
  SECURE_PATH is set at compile time.

In my opinion, sudo's documentation is a bit ambiguous/unclear here, but
it's not an issue specific to FreeBSD and should be resolved upstream, so
I'd close this PR. Please let me know if you (dis)agree.

Regards,
Stefan
Comment 5 Stefan Walter freebsd_committer freebsd_triage 2007-04-04 09:15:25 UTC
State Changed
From-To: open->feedback

Awaiting feedback from originator.
Comment 6 Stefan Walter freebsd_committer freebsd_triage 2007-04-14 15:07:34 UTC
State Changed
From-To: feedback->closed

I don't see a bug here - modification of $PATH happens only when configure is  
given the parameter --with-secure-path, which is not the case with the port in  
its current version. If anyone wants to add that parameter to CONFIGURE_ARGS,  
he or she is free to send a patch.