6

man visudo explains that visudo will not (by default) use EDITOR or VISUAL environment variables.

It states that

"There is no easy way to prevent a user from gaining a root shell if the editor used by visudo allows shell escapes."

Now I am confused where the security risk lies. I believe that

  • only root can use visudo to edit /etc/sudoers
  • only root can change root's environment variables
  • root already has a root shell

There is probably a use case where this does not hold, but I can't think of it.

7
  • 2
    The short answer is that sudo visudo is not equivalent to sudo su if the editor does not allow shell escapes, but they are equivalent if the shell does allow shell escapes.
    – jayhendren
    May 13 '14 at 19:01
  • 1
    If you can edit sudoers, you can pretty much do anything you want.
    – cjm
    May 13 '14 at 19:38
  • @jayhendren: As @cjm pointed out, why should anyone but root be allowed to run sudo visudo in the first place? Are there any checks to prevent that user from granting itself permission to do sudo su that I am missing?
    – Fabian
    May 13 '14 at 20:07
  • 3
    I don't know for certain, but I wonder if the documentation means that there is a lack of an audit trail when commands are executed from the editor? Not that there is a security hole per se, but that commands can be executed from the editor that will not be individually logged? Much the same as adding permission to run sudo bash. That's all I can come up with. May 13 '14 at 20:13
  • I believe @mtmiller has hit the nail on the head.
    – Barmar
    May 13 '14 at 20:14
6

I don't think there is an additional security risk from running an arbitrary editor from visudo strictly speaking. Clearly, the user running visudo already has permissions to edit /etc/sudoers, and therefore has the ability to add rules that will allow execution of any other commands on the system. So regardless of which editor is run, a user that can visudo can already execute whatever they want indirectly by adding a new sudo rule.

I think the advisory in the documentation about the EDITOR and VISUAL environment variables is about executing a root shell (or arbitrary command) while bypassing sudo's standard logging. By default, sudo logs all successful and unsuccessful authentications to syslog. This gives the system administrator an audit trail about which users are executing which commands through sudo. If a user changes /etc/sudoers with visudo, that can be seen by checksumming or reviewing the file. However, if a user can get a root shell through visudo, they can execute arbitrary commands without any audit trail.

So the security risk is the same as granting permission to run sudo bash, namely that a user with that privilege can get a root shell and execute arbitrary code without any restriction or logging of the commands that are run.

3
  • That makes sense. I did not think of the audit trail.
    – Fabian
    May 13 '14 at 23:10
  • But - a user can get a root shell through visudo
    – jalanb
    Oct 15 '15 at 22:14
  • 1
    @jalanb if the editor(s) configured to be used by visudo allow executing arbitrary commands, yes. Oct 16 '15 at 13:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.