Re:Sudo: Heap-based overflow with small passwords
by user3939382 on Friday November 04, 2022 @09:56AM
(#33466738)
> communicate which sort of permissions are needed
OpenBSD has something like this https://man.openbsd.org/pledge.2
Re:Sudo: Heap-based overflow with small passwords
by unsafecast on Friday November 04, 2022 @11:09AM
(#33467999)
Unfortunately not. Pledge is _awesome_, but it's a different thing.
Pledge protects the system from buggy well-intentioned, cooperative software that could have bugs. What's needed is something that protects the system from ill-intentioned, uncooperative software.
Re:Sudo: Heap-based overflow with small passwords
by unsafecast on Friday November 04, 2022 @03:41PM
(#33472640)
> buggy well-intentioned, cooperative software that could have bugs
Ugh, that's what I get for not reading before clicking submit...
Re:Sudo: Heap-based overflow with small passwords
by BeefWellington on Friday November 04, 2022 @02:49PM
(#33471821)
SELinux was intended to address this very thing. It's a complex beast that people find too difficult to understand and thus usually it gets disabled.
I see this attitude in pentesting too on embedded systems. A developer encounters a problem they don't quite understand but the problem disappears when they run their app as root, so away we go.
For installing things, you generally need write permissions to /usr/bin and likes. So you could create an user with such privileges and sudo to that.
The real issue, I think, is Linux not being capability based, so there's no programmatic way for scripts to communicate which sort of permissions are needed.