search

Duncaen / OpenDoas

A portable fork of the OpenBSD `doas` command
Other
626 stars 36 forks source link

doas should prefer executables in system PATH over local #128

Open JWMKit opened 2 months ago

JWMKit commented 2 months ago

doas should prefer executables in system PATH over local (in $HOME)

or maybe it should ignore the local paths?

worse case example

assume this line is in the doas.conf permit nopass user as root cmd poweroff

and ~/.local/bin is in the user's exec PATH

If you create a "Fake" poweroff executable in ~/.local/bin

then run the command doas poweroff

it will run the fake poweroff as root instead of the real one

Things to consider: ~/.local/bin does not require root access to write

no password is requested thanks to the nopass configuration.

*Edited due to inaccuracy. See below

Addition : This does not apply to commands specifically specified with nopass

ericonr commented 2 months ago

https://github.com/Duncaen/OpenDoas/blob/b96106b7e34ac591ae78b1684e9be3a265122463/doas.conf.5#L79-L95

What exactly gave you that impression?

JWMKit commented 2 months ago

OK I have egg on my face. Sorry about that. I'll edit my original post so not to spread miss-information. I don't know why I had the problem when I tested it.

So yes the nopass part was wrong

On the other had it still will runs the fake command as root with the password So it's not as serious, but but it does seem you could trick a user with a fake executable. They would happily give their password if they thought they were running a known command like man or apt

or maybe I'm a little paranoid.

ericonr commented 2 months ago

If someone can write into $HOME/bin they can just as well write into your shell config and change all kinds of behavior. doas could be a function which does $whatever with your password. Do you run type doas every time before you call doas to see if it's been overridden? What if they fully replace your shell and now not even /usr/bin/doas is safe?

I think you're being paranoid (or not enough :p)

But if that's important to you, change the config to set a known PATH for that rule!

JWMKit commented 2 months ago

I think it's a reasonable concern, so I'll be changing it in my own config. But I'm not gonna fall for some random guy on the internet telling me to save a file in my exec path, so It's not me that need the config, but better safe than sorry.

EDIT : Thanks for your time. I'll leave the issue open in case you have unfinished business.

ericonr commented 2 months ago

I can't close it, that'd be up to Duncaen