Repository navigation
sudoers_check_cmnd: don't convert an intercepted sudoedit to edit mode - #578
Merged
Merged
Conversation
When a command running under intercept execs a file named "sudoedit", the policy check for it converted the request to edit mode just like "sudo sudoedit". MODE_INTERCEPT_MASK strips MODE_EDIT on purpose, but the conversion added it back, so the plugin returned the editor as the command to run with the files to edit as its arguments. The front end execs that directly in the intercepted process, so the editor ran as the runas user on the real file instead of on a temporary copy. Only do the "sudo sudoedit" conversion for the initial command. An intercepted exec of sudoedit is now checked as an ordinary command.
millert
approved these changes
Oct 23, 2026
millert
left a comment
millert
left a comment
Collaborator
There was a problem hiding this comment.
Thanks, I didn't consider and intercepted sudoedit when that change was made.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
With
Defaults intercept, a command that execs a file namedsudoedit(the real/usr/bin/sudoeditor any file with that basename) reachessudoers_check_cmnd()as an interceptedMODE_RUNrequest.MODE_INTERCEPT_MASKremovesMODE_EDITon purpose, but the "sudo sudoedit" conversion puts it back. The plugin then returnscommand=<editor>with argv{editor, --, file}, andexec_intercept.cexecs that in the intercepted process, which already runs as the runas user and ignoressudoedit=true. A user with an intercepted command that can exec an arbitrary path plus any sudoedit rule therefore gets the editor running as root on the real file instead of on a temporary copy. The path lookup is skipped in edit mode, so theintercept_allow_setidcheck sees an empty stat. Authentication is also skipped for intercepted commands.Skip the conversion for intercepted commands so the exec is checked as an ordinary command. To confirm, I drove
sudoers_policy.check_policy()twice with the fuzz_policy stubs: first an initial command, then the intercepted sub-command/usr/bin/sudoedit /etc/motd. Before the change the second call returnedcommand=/usr/bin/vi, argvvi -- /etc/motd,runas_uid=0. After it, the call is checked as/usr/bin/sudoeditin run mode.make checkin plugins/sudoers passes exceptsudoers/test2 (toke), which also fails on an unmodified tree.