New issue
Advanced search Search tips

Issue 725678 link

Starred by 3 users

Issue metadata

Status: Assigned
Owner:
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Chrome
Pri: 3
Type: Feature

Blocked on:
issue 725626

Blocking:
issue 457066
issue 724937



Sign in to add a comment

investigate reducing need for sudo in verified mode

Project Member Reported by vapier@chromium.org, May 23 2017

Issue description

sudo is setuid root.  while we want to keep this around for dev mode users, killing it off in non-dev mode is desirable to reduce exploitation angles.

first attempt was to mount /bin/false over top of it:
  https://chromium-review.googlesource.com/507991

but that broke a few users and was reverted via  issue 724937 .

grepping in platform2/ shows a few weird uses of sudo that we should be able to kill off by using different commands/approaches.

but rather than reland CL:507991, we should install a script/program that logs+crashes attempts to use rather than silently exit(1).  that way we'll have tangible details to track and help with triage.
 
Another reason to get rid of sudo: http://seclists.org/oss-sec/2017/q2/358.

Comment 2 Deleted

Comment 3 Deleted

Project Member

Comment 4 by bugdroid1@chromium.org, Jun 6 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/platform2/+/74e546e71bafade7ca8b90e9b2e2c88a68a743a2

commit 74e546e71bafade7ca8b90e9b2e2c88a68a743a2
Author: Mike Frysinger <vapier@chromium.org>
Date: Wed Jun 06 08:16:23 2018

init: chromeos-cleanup-logs: drop sudo usage

This script already runs as root, so there's no need to use sudo.

BUG=chromium:725678
TEST=precq passes

Change-Id: I14667db62a7730aa208a80a7d7bcb7fa69210880
Reviewed-on: https://chromium-review.googlesource.com/1087413
Commit-Ready: Mike Frysinger <vapier@chromium.org>
Tested-by: Mike Frysinger <vapier@chromium.org>
Reviewed-by: Dan Erat <derat@chromium.org>

[modify] https://crrev.com/74e546e71bafade7ca8b90e9b2e2c88a68a743a2/init/chromeos-cleanup-logs

Project Member

Comment 5 by bugdroid1@chromium.org, Jun 21 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/platform2/+/e615bc37be6f86797251ba5ea3c26d46304c96a1

commit e615bc37be6f86797251ba5ea3c26d46304c96a1
Author: Micah Morton <mortonm@chromium.org>
Date: Thu Jun 21 19:17:56 2018

chromeos-common-script: call sudo only when needed

Run sudo only when non-root.
When root, just /sbin to path to be sure command will run.

BUG=chromium:725678
TEST=Check build image and chromeos-install still work
Run try-bot eve-arcnext

Change-Id: I60965f6515aa80541abc680d7c1d5501051b1eac
Signed-off-by: Gwendal Grignou <gwendal@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/1107483
Reviewed-by: Mike Frysinger <vapier@chromium.org>

[modify] https://crrev.com/e615bc37be6f86797251ba5ea3c26d46304c96a1/chromeos-common-script/share/chromeos-common.sh

Blocking: 457066
Status: Assigned (was: Available)

Sign in to add a comment