sudo-rs: A memory safe implementation of sudo and su

We’d love to get a report for this! While we are sure we will make bugs (which is also why we have the notice up on the repository, and you have to go through some hoops in order to use it), we also think that we can try and come up with an implementation that is safer in other ways as well. And if nothing else then at least some good attention will hopefully be drawn to sudo, because it can use a little care and attention.

About one decently exploitable bug a year or so over the past few years.

Not all of them have been memory safety issues, but many have been.

https://www.cvedetails.com/vulnerability-search.php?f=1&prod... finds quite a few: double free, array out of bounds, buffer overflows in the stack and the heap…

There's also a format string vulnerability that wouldn't exist in Rust and which C turns into privilege escalation instead of aborting.

Yes - and with better results I think :)

doas(1)

- doas(1) - portable version has about 500 lines of code

- doas(1) man pages - 157 lines long

- doas(1) had 2 CVEs

sudo(8)

- sudo(8) - about 120,000 lines of code (100x more)

- sudo(8) man pages - 10 000 lines long

- sudo(8) had 140 CVEs

The CVEs comparison is from 'all time' and as sudo(8) has longer history then doas(1) - it will (at least statistically) have more of these ... I expect doas(1) to have about 5-10 CVEs when they would have the same life span.

Regards,

vermaden