Bugzilla – Bug 912
Sudoedit can be tricked through symlinks from a temporarily nonwritable directory
Last modified: 2020-06-19 06:14:41 MDT
Sudoedit (sudo -e) normally disallows any symlinks in the path to the edited file that lie in user-writable directories. This was implemented in response to bug 707. However, that logic does not take into account that a user can change the write permissions of his/her own directories. Therefore, if given a permission to use sudoedit somewhere under his/her home directory, actually any file in the filesystem can be edited. Steps to reproduce: cd mkdir t ln -s / t/r chmod -w t sudo -e t/r/etc/shadow Perhaps it would be better to forbid any symlinks in the file path, no matter whether writable or not? Or somehow apply realpath before validating the access permissions? The latter would probably mean some new syntax in the sudoers file. Tested versions: 1.8.21p2 (from current Ubuntu 18.04.3 LTS) 1.8.30
The check should probably be expanded to include user-writable or user-owned directories.
Fixed in https://www.sudo.ws/repos/sudo/rev/91a1a9c0ba40
The fix was included in Sudo 1.8.31