2

I found the following answer to a FAQ question about a security problem in Oprofile:

This "problem" only occurs if you actively, and mistakenly, configure access to OProfile via sudo. OProfile uses shell scripts which have not been audited (nor is it likely to happen) for use through the broken sudo facility (anything that lets you alter root's path arbitrarily counts as horribly broken). Do not use sudo!

As I see it, the author of the answer suggests that sudo is broken, so that it should not be used not only with oprofile, but for other purposes as well. Are there better alternatives to sudo in Linux?

2
  • 3
    that faq is alarmingly unprofessional in its wording ;-/
    – Sirex
    Sep 4, 2012 at 23:54
  • 2
    It's only "broken" if you don't enable secure_path, then again it could be this vulnerability that they are talking about.
    – DerfK
    Sep 5, 2012 at 1:18

1 Answer 1

2

That FAQ looks very out of date, seeing as it cites a CVE from 2006.

There are some other alternatives to sudo but none are as mature (http://www.gnu.org/software/userv/).

Other ways to manage access would be to allow users su access to certain users, though this means you cannot audit users actions.

As DerfK mentioned above, you should enable secure_path when using sudo to avoid the problem of modifying "roots" path.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .