Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I noticed after running a sudo command in terminal or running a administrative application that uses gksudo, it won't ask again for the password for a time (something like 5 minutes).

Now let's assume one of the programs (not running as root) I'm using has a zero day exploit (like the web browser or its plugins). And an attacker manages to run arbitrary code on my behalf.

Is it possible for an attacker to do sudo or gksudo without the password prompt before the password expires and take over my system?

share|improve this question

3 Answers 3

up vote 5 down vote accepted

Yes, an attacker who is running code as your user can do anything that you can do yourself. It can even change your shell process so that when you think you're running sudo, you're actually running the attacker's program that just silently records your root password.

Ptys/ttys offer no security when they are owned by the same user, contrary to another answer on here.

share|improve this answer
    
The other answer isn't exactly wrong, just incomplete. sudo does prevent processes from different ttys from using the same access token, which seems like what the OP was hinting at, but they phrased it pretty broadly such that the answer is "sure, there's lots of scary stuff malicious processes can do" –  Michael Mrozek Oct 27 '12 at 22:37

Nope, it won't be.

sudo maintains access token by it's tty name (or pty), since the browser and your terminal emulator are running on different ptys, it won't use the same token.

An easy way to find it out, is running sudo in one terminal, and run it again in another one, you'd be prompted for password again (see /var/db/sudo)

share|improve this answer

"Is it possible for an attacker to do sudo or gksudo without the password prompt before the password expires and take over my system?"

Yes.

The easiest attack comes from an interactive shell and yourself not locking your screen when you walk away from your keyboard.

If you're worried, then change the line

Defaults        timestamp_timeout=90

in your /etc/sudoers, it changes the 5 minute timeout.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.