Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Maybe I am getting a little paranoid. Lately my MacBook Pro with Mac OS X 10.8.2 is behaving a little different the usual.

The last strange thing that happend was that in iTerm2 when I tried to sudo I get "XXXX is not in the sudoers file. This incident will be reported". I just updated iTerm2 after being prompted of an update. On the standard Mac OS X terminal everything works smoothly.

Can it be a rootkit that works on the stock terminal?

Any suggestions?

share|improve this question
    
Are you certain your user is an OS X Administrator? –  nathan Mar 6 '13 at 0:16
    
I used to be able to sudo without any problems and it is still working in the regular Terminal that is coming with the Mac OS X –  ElegantSolution Mar 6 '13 at 0:23

1 Answer 1

I assume that you are in the /etc/sudoers file. Therefore, things are working as expected in the stock terminal. Also, it would be weird for a rootkit of any ohter hack to remove you from your own sudoers file; rootkits enable extra accesses to the attacker, but don't disable access to the normal users (if only because functionality breakage attracts attention, exactly the opposite of what a rootkit aims at).

So all symptoms so far point at a bug in iTerm2 (especially since you just updated it), not at an attack.


My guess would be that iTerm2 changed the way it allocates its pseudo terminal. In Unix systems (including MacOS X), command-line utilities must run in a special device called a terminal; it is an input-output device which handles characters but also concepts such as a "terminal size" with a given number of columns and lines. This comes from a time when terminals where really tangible hardware, like that one (I spent many coding hours on a VT220). In less ancient systems, we have graphic cards, millions of pixels and colours, and terminal emulators which are applications like iTerm2 which make believe that there is still a terminal connected to the machine. To do its job, a terminal emulator obtains from the kernel a pair of pseudo terminals: these are two devices (i.e. special files), one which will look like a true terminal to the shell and command-line applications, and the other which offers a backwards view of the former. The terminal emulator translates what it reads from and writes to the second pseudo-terminal into graphical concepts like drawing characters on the screen.

Therefore sudo will run in a pseudo-terminal which was allocated and set up by iTerm2. sudo is known to be picky about terminals; see for instance the requiretty option in the man page. "For security reasons" (an all-time favourite excuse), sudo may require the terminal to be somehow "genuine" and linked to a real session from the operating system. To be compatible with these sudo requirements, terminal emulators must jump through a variety of hoops in a complex ritual dance. I find it possible that the iTerm2 update changed some obscure parameter which sudo now declares heretic, explaining the message.


As investigation steps, try to launch these commands in a standard Terminal and in iTerm2:

id
ls -la `tty`
w

First command will tell you who you are (from the point of view of the machine), second command will show the pseudo-terminal device currently in use, with access rights, and third command shows currently open "sessions" (then again with corresponding terminals). Any discrepancy between the two terminals could point at the proximate cause for your issue.

share|improve this answer
    
Thanks you. So those are the news. There are no differences across. The other strange thing is that now both work fine :-/ –  ElegantSolution Mar 6 '13 at 22:37

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.