Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.security > #5489

Which one is better solution?

Show all headers | View raw

Sometimes, I use a sudo command with -s options for keeping
environment variables for users account(sudoer). I also know -s option
runs the shell specified by the SHELL environment variable. But the
SHELL environment variable can be manipulated by other users having
the same privilege.

So, I think an adversary is able to abuse the changing SHELL
environment variable for privilege escalation like a video below. (I
assume the adversary owned the permission for executing a shell on a
remote)

https://youtu.be/JSQjIm7377o (unlisted state)

I know it is uncertain when the sudo is executed with -s option by sudoer.

Anyway, I have thought of the solutions to the issue below.
 - using a pkexec of a Policy kit,
 - disable a ptrace function via kernel.yama.ptrace_scope, CAP_SYS_PTRACE.

Could you give some advice and comments?

Thx.

Back to linux.debian.security | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

Which one is better solution? JungHwan Kang <ultractgm@gmail.com> - 2018-12-15 12:20 +0100
  Re: Which one is better solution? Shea Alterio <krusete@gmail.com> - 2018-12-15 12:30 +0100
    Re: Which one is better solution? Ruslanas Gžibovskis <ruslanas@lpic.lt> - 2018-12-15 17:30 +0100
      Re: Which one is better solution? Cindy-Sue Causey <butterflybytes@gmail.com> - 2018-12-15 22:30 +0100
      Re: Which one is better solution? Elmar Stellnberger <estellnb@gmail.com> - 2018-12-16 09:00 +0100
        u+S  WAS: Which one is better solution? Geert Stappers <stappers@stappers.nl> - 2018-12-16 10:20 +0100

csiph-web