First of all, let me mention that I’m assuming a configuration as set up by current Linux desktop distributions (e. g. Debian, Fedora). I’m sure that there are methods which, if implemented, would mitigate the issues described here. What I’m interested in is the security “out of the box”.
It seems to me that the fact that shells execute files like
~/.bashrc, which allow complete manipulation of a user’s execution environment and are owned by the user, destroys any hope that a program like
sudo can be run securely. The problem is that any malicious program running as the user can edit these files to, for example, modify the
PATH environment variable to include a fake
sudo executable, such as
PATH="$HOME/.evil:$PATH", where the malicious program also created a file
$HOME/.evil/sudo. Then, the next time the user types
sudo in a shell, the fake
sudo will be run instead and can record the typed password. Thus, the fake
sudo can obtain
root privileges even though the original malicious program only had user privileges.
In fact, the default
.profile file created by my installation of Ubuntu includes the following lines:
# set PATH so it includes user's private bin if it exists if [ -d "$HOME/bin" ] ; then PATH="$HOME/bin:$PATH" fi
so there is no need to even modify
.profile – just create
$HOME/bin/sudo and it’s already first on the
My point is not that it is already “too late” when arbitrary malicious code is run or that this attack could be noticed by the user (I suppose it is similar to a phising attack). I expect that a malicious program running as a user can do anything that the user could. What I would not expect is, however, that it can do more than that user (
My question is, in essence:
- Is it true that the system
sudoexecutable can be circumvented in this way?
- Why are desktop Linux systems, by default, set up in such an easily exploitable way? Shouldn’t the default way to invoke
sudomake sure that it is, in fact, the executable provided by the system (nobody is going to type
/usr/bin/sudoevery time)? Since
sudoperforms system-critical security operations, the possibility to shadow its location using the
PATHvariable seems to bring a lot of risk with little benefit. In such an environment, it seems that using
sudois fundamentally insecure and one would be better off enabling login as
rootand logging in on a separate TTY.