Bug 879 – backslash \ in userid

Bug 879 - backslash \ in userid


Summary:	backslash \ in userid

Status:	RESOLVED INVALID

Product:	Sudo
Classification:	Unclassified
Component:	Sudo
Version:	1.8.23
Hardware:	PC Linux

Importance:	low normal
Assigned To:	Todd C. Miller

URL:

Depends on:
Blocks:
	Show dependency tree / graph

Reported:	2019-04-20 17:12 MDT by trent
Modified:	2019-04-20 17:20 MDT (History)
CC List:	1 user (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description trent 2019-04-20 17:12:32 MDT

I have verified the following behavior in Ubuntu 18.04 Redhat 7 and 6.

Ubuntu 18.04  1.8.21p2
RHEL 7 sudo-1.8.23-3.el7
RHEL 6 sudo-1.8.6p3-29.el6_9

NORMAL
- $ \
> date \
> 
Sat Apr 20 23:05:41 UTC 2019

===
yes I have userid in /etc/sudoers for ROOT

$ sudo su - ro\ot
Last login: Sat Apr 20 23:03:43 UTC 2019 on pts/0
[root@ ~]# id
uid=0(root) gid=0(root) groups=0(root) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

$ sudo su - ro\\ot
su: user ro\ot does not exist


Is the processing of \ in userid normal? possible security 
issue with sudo, valid userid?

thank you.

Comment 1 Todd C. Miller 2019-04-20 17:20:29 MDT

Your shell is eating the single backslash so in the first example, what is actually run as "sudo su - root".  In the second example, the double backslash gets turned into a single backslash by your shell.  This really doesn't have anything to do with sudo itself.