Hacker News Reader

Comment by kingofclams | Hacker News Reader

Smaller, less features, ideally less vulnerabilities.

On the one hand, I get that not everybody needs all the features of sudo, but on the other.... Sudo is way more useful than doas. If you really go through all its functionality, you start using it in ways you didn't think to before.

You can have a custom AuthZ solution and automatically inherit sudo permissions based on groups. It supports a configurable askpass. You can background jobs, change working directory, selectively pass or set environment variables, set $HOME, use a login shell, preserve origin groups, use a chroot, read a password from STDIN, override the shell, set a timeout. And of course the sudoedit features.

I know we all like programs that "do one thing well", but sometimes the best way to support all the use cases we want is a big honking program.

Although it is annoyingly and quite critically missing a replacement for `sudo -e` / sudoedit (or was last time I checked).

alias suedit=‘doas …’

That is not at all what sudoedit does.

Not at all? Might wanna brush up on the manpage. The temp file is a feature but not essential to getting work done.

> The temp file is a feature but not essential to getting work done.

The entire point of sudoedit is to reduce the attack surface, without that it's absolutely useless since you can just `sudo` whatever editor you prefer.

Exactly. And could be trivially implemented.

What is wrong with `sudo vim /etc/foo`? I feel that it's better than `sudo -e`, but would love to see an example where `sudo -e` is better.

`sudo vim` will not load your user's vimrc, sudoedit will

It will also run your entire editor as root, which may not be something you want.

I actually would prefer the editor binary to run as root, rather than have my VIM config available. Any malware that could replace my system VIM would already have access to do whatever it wants to anyway. But malware to alter my own VIM configuration has a much lower barrier to entry.

Which is arguable an attack vector. Depending on how careless the user is, there is far more likely a chance that malicious code is found in .vimrc than is found in the VIM executable.

sudoedit runs your editor as you, not root, so unless I'm misunderstanding you, no such attack surface exists.

They’re probably referring to the attack surfaces of the extensions you have loaded in your normal configuration, as opposed to the probably empty environment of root.

> What is wrong with `sudo vim /etc/foo`?

Aside from forcing vim onto innocent users?

> I feel that it's better than `sudo -e`, but would love to see an example where `sudo -e` is better.

It is way worse than `sudo -e`, because it runs the entire editor as root, whereas `sudo -e` runs a few file copies / move as root. So `sudo -e` has a significantly lower amount of stuff in the "secure zone", and thus, much in the same way `doas` is more secure than `sudo`, `sudo -e` is a lot more secure than running the entire editor.

It also works with anything you can set as $EDITOR.

Some editors (like vscode) will outright refuse to run as root by default.

  > Aside from forcing vim onto innocent users?

Actually, `sudo -e` forces VIM onto innocent users. You are free to `sudo nano` if that's your preference.

  > `sudo -e` runs a few file copies / move as root.

Interesting, thank you, I did not know that the editor is not run as root with -e. So presumably that means that it will have my environment, e.g. will run my .vimrc? Though that could be an attack vector too.

> Actually, `sudo -e` forces VIM onto innocent users

No, it does not. It runs whatever EDITOR is set to (technically the first set of SUDO_EDITOR, VISUAL, and EDITOR).

> So presumably that means that it will have my environment, e.g. will run my .vimrc?

That is correct.

> Though that could be an attack vector too.

Only on the specific file, which would usually be a lot more noticeable unless the attack specifically manages to recognise and target sudoedited files while closing the buffer.

  > Only on the specific file, which would usually be a lot more
  > noticeable unless the attack specifically manages to recognise
 > and target sudoedited files while closing the buffer.

I've seen far more sophisticated attacks than that. Though vimscript itself is kind of a barrier to entry ))

"sudo -e" prevents you committing a file with a syntax error, because that instantly locks you out of all sudo access.

The replies about security are interesting, but I think they are over-complicating this!

Reply on news.ycombinator.com