When working in environments where Linux and Windows operating systems are used together you have probably encountered discussions in the lines of "which one is more secure?".
One of the frequent statements which will be thrown out during these discussions will be something in the lines of "Linux is more secure because you're not having administrator rights all the time and you will sudo only when it is really needed!". And all Windows users just give up without going forward with this crap. Today, Windows Vista/7 also have similar feature called UAC which asks for administrative privileges every time when it is really needed. One could say that it makes Windows as secure as Linux. I'm not agreeing with that statement either - i think that the same feature is actually less secure in Linux as it is in Windows.
Wouldn't that cause a nice and clean feeling? Well, not if someone else does it to your drive! You might be thinking now: "Thankfully it is not possible to run that command without sudo rights...". Or isn't it? Fortunately you're right on this thing - it is not possible to run that command without sudo rights. But that's just one side of the problem.
How To Use That Knowledge Against Me?
It asks for a password as expected. So if we don't enter that password right now then we are safe. Okay, we could trick that user to enter a password at this moment to trigger that command, but it wouldn't be that fun. Let's try some different approach instead.
run, sudo will display an error messages and exit.
There you have it. The script is running in the background without showing any errors to the user.
Now, when you open up a new terminal window then that cool application will be started automatically in the background without you even knowing it. Cool, eh?It's going to get even cooler! Just use your terminal as you use it every day. If you're so called expert Linux user then you have it opened all the time and of course you do something which needs sudo rights, right? For example, you'd like to install some other cool applications once in a while with apt-get install. Why not do it right now? When you have that script running in the background and you enter password for sudo then you will lose potentially all your data! That's what i'd call cool if i'd do that to myself!
The problem is in the way how Linux elevates privileges by sudo. When you enter the password for sudo then the current process and it's subprocesses will be given sudo rights. That's where the .cool-app.sh will get also sudo rights and will start with the process of destroying your very secure Linux box.The same process works a little bit differently in Windows - administrative privileges will be given to the specified process and it's child processes, but not to the current process.
So, never run fishy scripts and binaries on Linux under a user with /sudo/ rights! This rule is universal and works even for Windows 98. :)What makes Linux more secure than Windows is that you don't have to download so much from fishy warez sites to get that little bit of useful functionality to your system. Centralized, peer-reviewed repositories make it a bit more secure in this regard.
"if having access to the file system in any way" - is not enough. You have no access to anybodie's home directory from any other. So if you have access to somebodies logged in account, it's understandable, that you can make lot of damage.
Thank you for your replies :)@Andrei: well, that's unfortunately always not possible - what if that fishy binary needs sudo rights rightfully? I'm not sure that every commit is reviewed on every software bit you're installing with apt-get install - i might be wrong of course and it could add some extra sense of security, but it's not foolproof either. And there's Java jars, Ruby gems, Python... well, you get the point. Then there's e-mail, internet with Java Applets, Flash and a lot of running software with possible vulnerabilities with access to the local filesystem.@Aleksandr: point of this post was not to cause damage under your local account, but do something more. When i have just access to somebodie's logged in account, i can't do much outside of his account due to missing administrative rights so i can only cause a mess related with his/her account. Also read my reply to Andrei about pointing out only few of the possible ways of getting access to your file system.
I found a thread from ubuntu forums about the same issue: http://ubuntuforums.org/showthread.php?t=1045209 It turns out there is an easy solution for the paranoid: Edit the sudoers file by adding ",timestamp_timeout=0" to the end of the line "Defaults env_reset".Now you have to type in your password every time you want to use sudo.
Normally, I don't use 'sudo'. Now what?
I am not a sudo user and I am a bit surprised, that there is an option like this. I think this option should be renamed as "give_all_my_processes_a_possibility_to_get_root_privileges_for_x_minutes" and after that I can't see a reason, why anyone would ever like to turn it on.I also think, that the title of this post is misleading, because the post is really about "Is Sudo Configuration Options As Secure As You Think?"
@Erik: the fact that you're not a sudo user doesn't mean that the problem doesn't exist. Every installation of Ubuntu creates the user as a sudo user for example.If the title would have been as you suggested it, then you wouldn't had probably read it :) Catchy titles are better. And on top of that, this default configuration affects the security of Linux, so it's not totally misleading either.
@Jarmo: Where exactly did I say, that problem does not exist? On the contrary, I think that this is a serious problem and such configuration options should not even be available in security critical software.But you are right about catchy title. I probably wouldn't have read the article if the title had mentioned a software I didn't use.
I might be mistaken as hell, but by default some fishy shell script does not have execution rights from the get-go, ne would need to do the "chmod +x" to get that up-and-running.
Pjotr: I don't understand what's the point of your statement, since "chmod +x" can be run without needing sudo rights. In other words, it doesn't add any additional security to the specified problem.
Not again.... Please, do not judge about GNU/Linux based on Ubuntu. On a sane distro you have sudoers file empty and it's the system maintainer's fault if he doesn't know how to properly setup sudoers file. Besides, your example shows what a user that has rights to use sudo directly can do to the system using some crazy approach. So I don't get the idea of your example. If you'd give such an example that a user not having sudo rights does that to the system that would be different. So far this post is total bs.
Nice comment, missing totally the point. Again. Also, OS X behaves the same, for example, so it's not only Ubuntu.The point of this post was in a really short sentence to show that in Linux (or Ubuntu, if that makes you comfortable) you can't be sure that entering your sudo password is a safe thing to do compared to running always as a root. Having an empty sudoers file or not having any sudo rights at all is completely different topic and doesn't have to do anything with this post or with this "attack vector", sorry.
a. chattr +i .bashrc executed as root, it's not a silver bullet but sure helps.b. Use something like http://cfv.sourceforge.net/ to validate your fs content.c. Use etckeeper to track changes made to config files.d. Use SELinux or AppArmor for mandatory access control.