Summary pretty much sums it up. I had set up a terminal with the IceWM-session startup script to start up with tail on /var/log/messages, and when everything it up and running, it doesn't require a password. If i'm not mistaken, this could (depending on the way sudoers file is set up) cause a serious problem if an attacker added a series of commands into the script, and cause problems.
i don't understand why a NOPASSWD: sudo entry is needed to realize a "tail -f /var/log/messages" which is very often world-readable. If an attacker can modify a user script, he already can execute code with this user permissions, so there's no security issue this side. Finally, if the /etc/sudoers file is too permissive, it's the problem of the person who edited this file. Please elaborate :)
Well, I cann't cat /var/log/messages on my system, nor tail it. It is a user-end problem, but making sure this kind of thing is shown. Too permissive a sudoer file can be dangerous, but it is STILL a problem. I havn't fully tested this kind of thing, so I'll get back to you when I can test it out better, but it is still a possible problem that I will also bring up with the IceWM devs. Currently I'm updating to gcc-4.1.1, so I'll have to do this a little later on, but I'll get some more info to see how bad a problem this could be
> but I'll get some more info to see how bad a problem this could be > yes, please tell us what it is possible to do for an attacker in the default sudoers config.
Any news on this one?
marking INVALID, you probably entered your password and it hadnt timed out, or you have entered a NOPASSWD line.
Apparently it has been solved. Don't know exactly why, but it seems to be. The only diffrence I made that would affect this is in the sudoers file I moved gpm to a NOPASSWD entry, and listed the rest after PASSWD, including tail. Sorry for the lack of replies, I've been rather busy with other things.
