Are sudo and gksudo safe?

Question

I noticed after running a sudo command in terminal or running a administrative application that uses gksudo, it won't ask again for the password for a time (something like 5 minutes).

Now let's assume one of the programs (not running as root) I'm using has a zero day exploit (like the web browser or its plugins). And an attacker manages to run arbitrary code on my behalf.

Is it possible for an attacker to do sudo or gksudo without the password prompt before the password expires and take over my system?

Answer 1

Yes, an attacker who is running code as your user can do anything that you can do yourself. It can even change your shell process so that when you think you're running sudo, you're actually running the attacker's program that just silently records your root password.

Ptys/ttys offer no security when they are owned by the same user, contrary to another answer on here.

Answer 2

Nope, it won't be.

sudo maintains access token by it's tty name (or pty), since the browser and your terminal emulator are running on different ptys, it won't use the same token.

An easy way to find it out, is running sudo in one terminal, and run it again in another one, you'd be prompted for password again (see /var/db/sudo)

Answer 3

"Is it possible for an attacker to do sudo or gksudo without the password prompt before the password expires and take over my system?"

Yes.

The easiest attack comes from an interactive shell and yourself not locking your screen when you walk away from your keyboard.

If you're worried, then change the line

Defaults        timestamp_timeout=90

in your /etc/sudoers, it changes the 5 minute timeout.