Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #190703

Re: vipw and vigr default editor

Show all headers | View raw

On Fri, Jan 05, 2018 at 09:37:16PM +0100, Ulf Volmer wrote:
> 
> That basically keeps the *whole* environment, what is usually a security
> issue. Better solution is to keep only needed and proved environment
> variables using
> 
> Defaults  env_keep += "EDITOR"
> 
Allowing the EDITOR variable through is a gigantic security issue.  Its
value gets passed as a command to the shell:

roberto@debian:~$ sudo EDITOR='echo "I have the power!"' vipw
I have the power! /etc/passwd.edit
vipw: /etc/passwd is unchanged

There is essentially no functional difference between allowing only the
EDITOR variable and any arbitrary environment variable.  Allowing EDITOR
(or PAGER, or any other thing that sets the name of a command to
execute) through to sudo provides an effective route to bypass any sudo
restrictions.

Regards,

-Roberto

-- 
Roberto C. Sánchez

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

vipw and vigr default editor John Ratliff <john@bluemarble.net> - 2018-01-05 21:10 +0100
  Re: vipw and vigr default editor Greg Wooledge <wooledg@eeg.ccf.org> - 2018-01-05 21:20 +0100
    Re: vipw and vigr default editor Ulf Volmer <u.volmer@u-v.de> - 2018-01-05 21:40 +0100
      Re: vipw and vigr default editor Greg Wooledge <wooledg@eeg.ccf.org> - 2018-01-05 21:50 +0100
      Re: vipw and vigr default editor Brian <ad44@cityscape.co.uk> - 2018-01-05 21:50 +0100
      Re: vipw and vigr default editor Roberto C. Sánchez <roberto@debian.org> - 2018-01-05 21:50 +0100
        Re: vipw and vigr default editor Ulf Volmer <u.volmer@u-v.de> - 2018-01-05 22:00 +0100
  Re: vipw and vigr default editor Roberto C. Sánchez <roberto@debian.org> - 2018-01-05 21:30 +0100
    Re: vipw and vigr default editor John Ratliff <john@bluemarble.net> - 2018-01-05 23:10 +0100
  Re: vipw and vigr default editor Charles Kroeger <ckrogrr@frankensteinface.com> - 2018-01-06 04:40 +0100

csiph-web