sudo-project / sudo

Utility to execute a command as another user
https://www.sudo.ws
Other
1.17k stars 210 forks source link

sudo does not honor user's default core file size limit #173

Closed scottm1llj closed 2 years ago

scottm1llj commented 2 years ago

Sudo used to honor all resource limits (as do su, login, ssh, etc). Starting with version 1.9.9, sudo began ignoring the user's core file size limit and just clobbering it with 0,0.

For example, consider a system where root's default hard limit for core file size is unlimited (e.g. having the following in /etc/security/limits.conf: root hard core unlimited).

Formerly, the following would give you the system default limit for that user: $ sudo bash -c "ulimit -Hc" unlimited

As of version 1.9.9 (e.g. the default in Ubuntu 22.04), we now get: $ sudo bash -c "ulimit -Hc" 0

This behavior change has been traced to the following commit:

commit f279df5e18023a0569657610513743a6bbdf7301 Author: Todd C. Miller Todd.Miller@sudo.ws Date: Mon Nov 8 17:46:19 2021 -0700

Add basic support for setting resource limits in sudoers.
The default for rlimit_core is "0,0"
Resource limits are passed back to the front-end in command_info[]
when set.

It is hard to believe that it should be considered correct behavior to ignore the system limits and clobber it with 0,0.

Currenly, I can no longer rely on sudo to run in an environment which picks up the default limits for the user. My only workaround is to use sudo in conjunction with su since su still establishes the correct default limits environment:

$ sudo su root bash -c "ulimit -Hc" unlimited

millert commented 2 years ago

Core dumps are disabled by default to avoid exposing sensitive information. To restore the historic core dump file size behavior, a line like the following in sudoers may be used:

       Defaults rlimit_core=default
scottm1llj commented 2 years ago

Thank you for your quick response. I can confirm that that works.

scottm1llj commented 2 years ago

(I finally found the description of this behavior and remedy in the sudoers man page. I had read the man pages for sudo and sudo.conf, but not sudoers:)