Request: Easy way to "elevate" programs

WizardStan

Mega GP Mania
Joined
May 24, 2008
Messages
16,733
You seem to forget that the key cloning machine is always present in everyone's house, so once someone gets inside, he can (and usually will) make himself a brand new key. The original key used to break in is then usually ditched in a deep cold river.
I didn't forget, it just doesn't change anything. I am not arguing whether it is safe or not, I'm still only saying that if someone is going to do something like this that it is safer to update the sudoers file manually, on a case by case basis so you know exactly what's going in there, than it is to have a script running as root do it for you.
So you will end up running every PND as root.
I didn't mean all of appdata, I just meant the appdata directory specific to the PND in question which is already being run as root.
 

dimag0g

Very Active Member
Joined
Jan 12, 2011
Messages
608
Location
Strasbourg, France
#1. I have a script which updates the sudoers files for me (I already posted the link to it). It does the following:

- backups the original sudores file

- asks the user for the command he wants to run without password

- checks that the command file exists, finding out the full path if necessary (using which, could also be modified to check /mnt/utmp/...)

- alters the sudoers file by inserting the new command (it also can remove commands btw)

- checks that sudo isn't broken

- if sudo is broken, restores the original sudoers from backup

- wipes out the backup file (may be made more secure with overwriting, but /tmp is wiped after a reboot anyway)

Of course, I could do all these steps manually, but what's the point? It's just more error-prone.

#2. Right, I stand corrected.
 

levi

Still fresh, damnit!
Joined
Oct 6, 2008
Messages
11,599
Location
Somewhere off the coast of the EU
For others reading this, it might be worth noting that visudo does all of that already, although it requires you to know the right sudoers syntax to achieve what you want (so your solution is easier if you want to NOPASSWD a specific command, but with visudo you can do a lot more). Learning the sudoers syntax is easier said than done though, so I'm not saying there's no point in your script, not at all.
 

WizardStan

Mega GP Mania
Joined
May 24, 2008
Messages
16,733
Of course, I could do all these steps manually, but what's the point? It's just more error-prone.
Security safety and proneness to error are not the same thing. They have overlaps but they're still not the same.Doing all the steps manually may be more error prone but it's still strictly safer than trusting that your script hasn't been compromised.
 

dimag0g

Very Active Member
Joined
Jan 12, 2011
Messages
608
Location
Strasbourg, France
I'm not saying that using a script to modify sudoers is safer than modifying it by hand. My point is that the risk coming from script usage is next to nothing compared to the risk of adding SD-resident programs to sudoers, or  installing PNDs from unverified sources.

By the way, my script is asking for password before usage.
 

TrashyMG

Sarcasm Dispenser
Staff member
Joined
Jan 18, 2010
Messages
10,641
or  installing PNDs from unverified sources.
outside of PXML checking, nothing on the repo is verified  anyone can check in a PND.. it's the users here in the community that can take notice of suspicious activities and report them.
 

dimag0g

Very Active Member
Joined
Jan 12, 2011
Messages
608
Location
Strasbourg, France
or  installing PNDs from unverified sources.
outside of PXML checking, nothing on the repo is verified  anyone can check in a PND.. it's the users here in the community that can take notice of suspicious activities and report them.
Yes! And how many of those users will notice a r00t account in passwd in a reasonable amount of time? I know I won't, I only checked that file maybe twice during the last two years.
 

TrashyMG

Sarcasm Dispenser
Staff member
Joined
Jan 18, 2010
Messages
10,641
or  installing PNDs from unverified sources.
outside of PXML checking, nothing on the repo is verified  anyone can check in a PND.. it's the users here in the community that can take notice of suspicious activities and report them.
Yes! And how many of those users will notice a r00t account in passwd in a reasonable amount of time? I know I won't, I only checked that file maybe twice during the last two years.
There are many here that sniff through the PNDs that are just released.. aTc is one I know who looks into the PNDs often and criticizes(And makes fun of) how the scripts are written especially if Zenity is used.  The other thing is many will notice if someone is remotely doing something on a Pandora.. SD card usage, drop in network speed when idle and what not, some people are so anal about memory usage they will notice oddities.. And lastly there has been known issues in the past, the Commander Beef (Streak) issue that happened a few years ago where people noticed that his applications was sending information without the users consent.. I also think how small the community is, people are scrutinizing the PNDs of anyone who is new to the community. 
 
Last edited by a moderator:

WizardStan

Mega GP Mania
Joined
May 24, 2008
Messages
16,733
I'm not saying that using a script to modify sudoers is safer than modifying it by hand.
Then why do you keep presenting arguments to everything I say? It's not like I haven't made it clear what my position is. If you aren't arguing against what I'm saying then what are you doing?
Is it strictly safer than trusting that sudo hasn't been compromised?
Yes. If sudo has been compromised it is compromised whether sudoers is being updated manually or automatically. It's a net zero either way.
 

dimag0g

Very Active Member
Joined
Jan 12, 2011
Messages
608
Location
Strasbourg, France
I'm not saying that using a script to modify sudoers is safer than modifying it by hand.
Then why do you keep presenting arguments to everything I say? It's not like I haven't made it clear what my position is. If you aren't arguing against what I'm saying then what are you doing?
Because it doesn't matter that much how you modify sudoers. What matters is how many programs do you run as root and in which locations they reside. Yes, a script which fiddles with sudoers is one more entry point, but there are enough equally good entry points for malicious code which are readily available. Consider this:

1. I use a script which modifies sudoers. Someone compromises it (by stuffing code to its appdata folder for example), and the next time I run it, bad stuff happens on my pandora.

2. You use some other PND which requires root access (SGX driver installer, Java installer, Claws mail, aircrack-ng, partition editor, C dev tools, you name it). Someone compromises it in exactly the same way, and the next time you run it, bad stuff happens to your pandora.

Frankly as an intruder I'd rather target some popular PND with thousands of downloads. And once I get root access, I would definitely remove all traces leading to my entry point.

Remember that metaphor of key vs. key cloning machine? My argument is that those are exactly the same in terms of security.

Doing all the steps manually may be more error prone but it's still strictly safer than trusting that your script hasn't been compromised.
Is it strictly safer than trusting that sudo hasn't been compromised?
You mean visudo? That's what you use to modify the sudoers file.
 
Last edited by a moderator:

WizardStan

Mega GP Mania
Joined
May 24, 2008
Messages
16,733
Yes, a script which fiddles with sudoers is one more entry point
One more is still one more.A million and one is bigger than a million. It doesn't matter that the difference is negligible, there is still a difference, that is my point. You can go on and on forever talking about how it is already intrinsically unsafe but you are literally preaching to the choir here: I know and understand everything you are saying about the difficulties of security which is why I insisted on saying only the one thing that I did, because there is nothing new to be learned from the discussion that you're attempting to have: you and I both know it all, we would just be yelling things that we already know at each other, which is what you are doing.
 

thatgui

Advanced Member
Joined
Apr 2, 2009
Messages
3,048
That's the difference: giving a friend a key is like manually updating the sudoers file so that one app has root access. Maybe that friend gets compromised, but it's just one key and you'll know where it came from because of what was exploited. If you grant explicit permission to ABC.PND and you become compromised you can discover that ABC.PND was ...
I still don't know where you are going here. B-ZaR already provided an easy to understand scenario, that shows that "just" granting some executable that lies in the user security context permanently elevated priviliges is a bad idea.

One more is still one more.

A million and one is bigger than a million. It doesn't matter that the difference is negligible, there is still a difference, that is my point.
That may be theoretically true, but practically isn't noteworthy, unless you personally check every newly installed binary or library for unsafe code.
 

WizardStan

Mega GP Mania
Joined
May 24, 2008
Messages
16,733
"just" granting some executable that lies in the user security context permanently elevated priviliges is a bad idea.
And as I keep saying I'm not saying anything about whether the idea in general is good or bad, simply that having having something automated do it is strictly less safe than doing it manually.
 

thatgui

Advanced Member
Joined
Apr 2, 2009
Messages
3,048
"just" granting some executable that lies in the user security context permanently elevated priviliges is a bad idea.
And as I keep saying I'm not saying anything about whether the idea in general is good or bad, simply that having having something automated do it is strictly less safe than doing it manually.
I disagree, it's all about how you handle it. But to be sure we are not talking cross-purposes, you are specifically talking about having a program altering the sudoers file ?
 

WizardStan

Mega GP Mania
Joined
May 24, 2008
Messages
16,733
you are specifically talking about having a program altering the sudoers file
An automated process modifying the sudoers file, yes, something that just goes off and does its thing as soon as you insert an SD card without any other user input.
 

thatgui

Advanced Member
Joined
Apr 2, 2009
Messages
3,048
you are specifically talking about having a program altering the sudoers file
An automated process modifying the sudoers file, yes, something that just goes off and does its thing as soon as you insert an SD card without any other user input.
Ahh ok, that was never my intention. My idea (at least in my head) would have always required that the actual change would have needed a "manual" acknowledge from the user.
 

WizardStan

Mega GP Mania
Joined
May 24, 2008
Messages
16,733
Ahh ok, that was never my intention. My idea (at least in my head) would have always required that the actual change would have needed a "manual" acknowledge from the user.
Ah, I see now. It's still insecure, but at least it's not fully automated insecurity.
 
Top