trifectatechfoundation / sudo-rs

A memory safe implementation of sudo and su.
Other
2.9k stars 79 forks source link

Its not suportated/implementeded yet " wanna try with old sudo?" #728

Closed MarceloMachadoxD closed 1 year ago

MarceloMachadoxD commented 1 year ago

Reading the readme.md about the message when something isnt implemented yet im Just thinking in a way to easly improve the compatibility with not implemented functions, if the function isnt implemented it can ask to user to use regular old sudo and something like a -- oldsudo to automatic use regular sudo on any not supported command or other failures like i read that deno or another thing is doing

pvdrz commented 1 year ago

Calling other binary doesn't seem like a good idea from a security point of view. If we call the original sudo implementation for a feature we don't have, it also means we inherit any vulnerabilities that the original implementation has.

Given that both sudo-rs and the original sudo implementation support more or less the same sudoers format with some minor exceptions, the user can always call the original sudo implementation themselves if they want to use a feature that sudo-rs lacks.

I'm not strictly opposed to emit a message suggesting to use the original implementation but I think it is not very helpful as most users would be aware of that implementation existing.

squell commented 1 year ago

I agree with @pvdrz. Also, with packaging we will be running into the issue that, to use the binary name sudo, we essentially have a packaging conflict with ogsudo, so that means we would have to either use a non-standard installation location (which users are of course free to do) or ship with original sudo using a non-standard name. So aside from the security issue this also runs into practical problems.