Sudo user running app: can it be elevated to be root by app?

eastwater

7/3/24, 11:17 PM

e.g.,

user "user_xyz" is a regular user in sudo group.

 sudo command

Does not require password.

If the user run an app, can the app elevate the user to be a root user causing security issue?

1 + 0

security

ubuntu

sudo

Score:0

Server

HBruijn

7/4/24, 9:56 AM

user "user_xyz" is a regular user in sudo group.

Do not add untrusted users to the sudo group

The sudo group in Ubuntu is a special purpose group, making a regular user a member there grants them full administrator rights; and they are no longer a "regular" user. By design and by default that group membership grants the user unrestricted sudo privileges. Administrators in the sudo group can use the sudo command to run any command or tool with full privileges and access all data and settings of all other users, services and components on that system.

# Uuntu defaults in /etc/sudoers
...
# Allow members of group sudo to execute any command
%sudo   ALL=(ALL:ALL) ALL

Group membership in the sudo group also grants administrator privileges elsewhere in addition to sudo, for example in PolicyKit / polkit enforced policies for (GUI) applications.

# Ubuntu defaults in /etc/polkit-1/localauthority.conf.d/51-ubuntu-admin.conf
[Configuration]
AdminIdentities=unix-group:sudo;unix-group:admin

If the user run an app, can the app elevate the user to be a root user causing security issue?

Even when you don't add the user to the sudo group and instead create a sudoers policy that will only allow your user to run a single command/application with sudo and at elevated root privileges, be aware that often there unexpected ways in which the user might be able to use that limited access to gain more privileges than you intended.

See for example the Q&A here about using sudo rights to a text editor to gain more privileges : Why is it risky to give sudo vim access to ordinary users?

Even limited sudoers policies should only be granted to users that are to be trusted.

+ 0

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: Sudo user running app: can it be elevated to be root by app?

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.