[Pkg-mc-devel] Bug#501303: sudo with mc provides root privileges to users

[Sven Joachim]

On 2008-10-06 14:25 +0200, Mathieu RV wrote:

> Package: mc
> Version: 1:4.6.1-6
> Severity: critical
> Tags: security
> Justification: root security hole

No, this is not a security hole.  Not even a bug, BTW.

> When a user appearing in the sudoers file use the following command :
> $sudo mc
>
> Midnight Commander starts within a root shell.

It rather starts a root subshell itself.

> Look at the bottom left of the mc screen : root at computer:~#
> Also, 'whoami' reports 'root'.
> Then the user as full access to the filesystem has the root user.

Yes, this is by design.  It also happens when you use "sudo bash", for
instance.

> It occurs even if the sudoers file do not allow access to the /usr/bin/su command to the user.
>
> I don't know if it is a feature, but it looks strange to me. I think that system administrators using sudo functionnalities should be aware of this 
> behaviour.

Administrators using sudo should know how it works, indeed.  If they
don't want to give users full access to the system, they must not let
them run mc or any other program that offers file management facilities
and shell access.

Sven