{"id":212,"date":"2009-12-11T00:11:14","date_gmt":"2009-12-10T21:11:14","guid":{"rendered":"http:\/\/www.held.org.il\/blog\/?p=212"},"modified":"2009-12-11T00:11:14","modified_gmt":"2009-12-10T21:11:14","slug":"sudo-make-me-sandwich","status":"publish","type":"post","link":"http:\/\/www.held.org.il\/blog\/2009\/12\/sudo-make-me-sandwich\/","title":{"rendered":"Sudo make me a sandwich"},"content":{"rendered":"<h2><a href=\"http:\/\/xkcd.com\/149\/\"><img class=\"alignleft\" style=\"margin: 5px; border: 0px initial initial;\" title=\"XKCD sandwich comic cc-by-nc xkcd.com\" src=\"http:\/\/imgs.xkcd.com\/comics\/sandwich.png\" alt=\"\" width=\"150\" \/><\/a>Sudo<\/h2>\n<p><strong>Q: How come \"<em>which ifconfig\" (<\/em>runing as a user)\u00c2\u00a0finds nothing, yet \"<em>sudo ifconfig\" <\/em>does work?<\/strong><\/p>\n<p><strong>A: <\/strong>sudo has a <strong>compile-time<\/strong> parameter called <em>with-secure-path,<\/em> which sets a different PATH for the sudo environment. Debuntu\u00c2\u00a0<em>secure path<\/em> contains \/sbin:\/usr\/sbin, and that's how it works. This feature gets two goals: convenience (no full path required for common root cmds) and security (ignoring potentially bad user PATH).<\/p>\n<p>NOTE that RHEL doesn't use this option, and running \"<em>sudo ifconfig\" <\/em>there\u00c2\u00a0simply fails.<\/p>\n<p><strong>Q: How come sudo requests a password only on the first run?<\/strong><\/p>\n<p><strong>A:<\/strong> Sudo has a nice mechanism for creating these \"sudo session\" things. After authentication, sudo creates a 'timestamp dir' (in \/var\/run\/sudo on my Debian), then uses its date to check when the last successful authentication took place.<\/p>\n<ul>\n<li>Session timeout is configurable, defaults to 15mins.<\/li>\n<li><em>sudo -k<\/em> kills this session by simply removing the timestamp dir.<\/li>\n<\/ul>\n<p>All info is found in the <a href=\"http:\/\/linux.die.net\/man\/8\/sudo\">sudo(8)<\/a> and <a href=\"http:\/\/linux.die.net\/man\/5\/sudoers\">sudoers(5)<\/a> manpages<\/p>\n<h2>Setuid and LD_LIBRARY_PATH<\/h2>\n<p>Just a quick insight from my workplace: to my surprise, a setuid binary <a href=\"https:\/\/bugzilla.redhat.com\/show_bug.cgi?id=129682#c1\">deliberately ignores many environment variables<\/a> such as LD_LIBRARY_PATH and LD_PRELOAD.<\/p>\n<p>Security Shmecurity..<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Sudo Q: How come &#8220;which ifconfig&#8221; (runing as a user)\u00c2\u00a0finds nothing, yet &#8220;sudo ifconfig&#8221; does work? A: sudo has a compile-time parameter called with-secure-path, which sets a different PATH for the sudo environment. Debuntu\u00c2\u00a0secure path contains \/sbin:\/usr\/sbin, and that&#8217;s how it works. This feature gets two goals: convenience (no full path required for common root [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[75],"tags":[198,74,203,102,113,114],"_links":{"self":[{"href":"http:\/\/www.held.org.il\/blog\/wp-json\/wp\/v2\/posts\/212"}],"collection":[{"href":"http:\/\/www.held.org.il\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.held.org.il\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.held.org.il\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"http:\/\/www.held.org.il\/blog\/wp-json\/wp\/v2\/comments?post=212"}],"version-history":[{"count":0,"href":"http:\/\/www.held.org.il\/blog\/wp-json\/wp\/v2\/posts\/212\/revisions"}],"wp:attachment":[{"href":"http:\/\/www.held.org.il\/blog\/wp-json\/wp\/v2\/media?parent=212"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.held.org.il\/blog\/wp-json\/wp\/v2\/categories?post=212"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.held.org.il\/blog\/wp-json\/wp\/v2\/tags?post=212"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}