PAM timestamp - how to inspecting the /var/run/sudo/<user> file?

Question

The centos documentation stated that:

... In the PAM timestamp scheme, the graphical administrative application prompts the user for the root password when it is launched. When the user has been authenticated, the pam_timestamp.so module creates a timestamp file. By default, this is created in the /var/run/sudo/ directory. If the timestamp file already exists, graphical administrative programs do not prompt for a password. Instead, the pam_timestamp.so module freshens the timestamp file, reserving an extra five minutes of unchallenged administrative access for the user.

You can verify the actual state of the timestamp file by inspecting the /var/run/sudo/ file. For the desktop, the relevant file is unknown:root. If it is present and its timestamp is less than five minutes old, the credentials are valid. ...

I then check the file, it's binary format:

[xiaobai@xiaobai note]$ sudo cat /var/run/sudo/ts/xiaobai 
(�r�3�+�[xiaobai@xiaobai note]$ 
[xiaobai@xiaobai note]$ sudo hexdump -C /var/run/sudo/ts/xiaobai
00000000  01 00 28 00 02 00 00 00  e8 03 00 00 72 17 00 00  |..(.........r...|
00000010  06 34 00 00 00 00 00 00  4e a7 c9 3a 00 00 00 00  |.4......N..:....|
00000020  01 88 00 00 00 00 00 00                           |........|
00000028
[xiaobai@xiaobai note]$
...
[xiaobai@xiaobai note]$
(�ry5S�V�[xiaobai@xiaobasudo hexdump -C /var/run/sudo/ts/xiaobai
00000000  01 00 28 00 02 00 00 00  e8 03 00 00 72 17 00 00  |..(.........r...|
00000010  af 35 00 00 00 00 00 00  5d 1a 24 07 00 00 00 00  |.5......].$.....|
00000020  01 88 00 00 00 00 00 00                           |........|
00000028
[xiaobai@xiaobai note]$

and the number slowly increase from 4 and 5 and i though it's minute. By i might be wrong because i noticed when it reached 9, it seems like longer than 1 minute. And after 9, it become more and more unreadable:

xiaobai@xiaobai note]$ sudo hexdump -C /var/run/sudo/ts/xiaobai
00000000  01 00 28 00 02 00 00 00  e8 03 00 00 72 17 00 00  |..(.........r...|
00000010  30 3b 00 00 00 00 00 00  59 f9 63 32 00 00 00 00  |0;......Y.c2....|
00000020  01 88 00 00 00 00 00 00                           |........|
00000028
[xiaobai@xiaobai note]$ sudo hexdump -C /var/run/sudo/ts/xiaobai
00000000  01 00 28 00 02 00 00 00  e8 03 00 00 72 17 00 00  |..(.........r...|
00000010  32 3b 00 00 00 00 00 00  ad 72 8f 1b 00 00 00 00  |2;.......r......|
00000020  01 88 00 00 00 00 00 00                           |........|
00000028
[xiaobai@xiaobai note]$ 

So my 1st question is, how should i inspecting the /var/run/sudo/user file which was in the binary format? The doc stated that "If it is present and its timestamp is less than five minutes old, the credentials are valid." How this <5 minutes information represented in this binary format?

And my 2nd question, does PAM timestamp(pam_timestamp.so) and timestamp_timeout(/etc/sudoers) is the same thing?

p/s: I tested it in Fedora 21.

Answer 1

If you follow the next link on the documentation page: http://www.centos.org/docs/5/html/5.2/Deployment_Guide/s2-pam-timestamp-remove.html you can find a reference to the pam_timestamp_check utility.

The pam_timestamp_check utility will check the validity of the file and the return value can be checked.

See also man pam_timestamp_check for details.

On my system (Linux Mint) I also found out that pam_timestamp_check always returns exit code 7 - Timestamp is not valid. Using strace pam_timestamp_check to debug the process it returns exit code 2 - The binary is not setuid root. After making the binary setuid using chmod u+s /usr/bin/strace I was able to trace the process:

lambert # strace pam_timestamp_check root
.
.
lstat("/var/run/sudo/lambert/9:root", {st_mode=S_IFREG|0600, st_size=57, ...}) = 0
access("/var/run/utmpx", F_OK)          = -1 ENOENT (No such file or directory)
open("/var/run/utmp", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
access("/var/run/utmpx", F_OK)          = -1 ENOENT (No such file or directory)
open("/var/run/utmp", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
exit_group(7)                           = ?
+++ exited with 7 +++

From this output I can see that /var/run/utmp is checked and can not be found.

Searching on my filesystem turns out that the utmp file is located in /run/utmp instead of /var/run/utmp. After creating the file using:

touch /var/run/utmp
chmod 664 /var/run/utmp
chown root:utmp /var/run/utmp

I was able to start a fresh sudo session (from a new terminal):

lambert $ sudo su
lambert # ls -l /var/run/utmp
-rw-rw-r-- 1 root utmp 384 mei 12 21:59 /var/run/utmp
#logout
lambert $ pam_timestamp_check root
lambert $ echo $?
0