Linux

8334 readers

351 users here now

A community for everything relating to the GNU/Linux operating system (except the memes!)

Also, check out:

Original icon base courtesy of lewing@isc.tamu.edu and The GIMP

founded 2 years ago

MODERATORS

Ategon@programming.dev

anzo@programming.dev

dwraf_of_ignorance@programming.dev

Sudo-rs make me a sandwich, hold the buffer overflows (www.theregister.com)

submitted 2 months ago by cm0002@lemmy.world to c/linux@programming.dev

5 comments fedilink hide all child comments

all 6 comments

sorted by: hot top controversial new old

[+] A_norny_mousse@feddit.org 1 points 2 months ago (2 children)

[deleted]

[–] cm0002@lemmy.world 11 points 2 months ago (1 children)

But this is not the first system package replaced by a rust rewrite (on some distros) - something that has been working well for so long and is so fundamental for so many other softwares - is that wise?

Was there ever a problem wrt memory safety with sudo?

There's been plenty of cases of a piece of software/library/whatever "working well" for years until one day OOPS there's actually a gaping vulnerability in it. Hopefully, it's a researcher that finds it first so it can be patched, but that doesn't always happen. That's how there's a whole market for "0 days"

"Working well" != "Secure"

[–] nous@programming.dev 11 points 2 months ago (1 children)

Yeah, and sudo is not some special case either as there are plenty of CVEs for sudo specifically due to buffer overflow or other memory issues over the years. There are likely more hiding and waiting to be found.

Only issue here is sudo is a lot more mature then sudo-rs and memory issues are not the only exploitable bug that can happen. It does look like sudo-rs has gone through at least one security audit though that only found a moderate and couple of low sev issues. Would be good to have more people audit it though.

[–] pohart@programming.dev 1 points 1 month ago* (last edited 1 month ago)

I think long term a rust version is a better choice. I do worry about exploits in immature code, though.

[–] Pika@sh.itjust.works 1 points 2 months ago

reading web pages yes there was, I never personally had an issue with it though. Being said I am for the change, binging some of the older components to a newer easier to maintain codebase is a good thing in my eyes.

[–] nesc@lemmy.cafe 0 points 2 months ago* (last edited 2 months ago)

Meh, what's the point? We have run0 installed by default now, everywhere. Sudo itself could be installed for compatibility, another super-secure-fast whatever makes no sense.