bugGNU Screen - Bugs: bug #45381, sudo screen - bash logs root...

 
 

bug #45381: sudo screen - bash logs root commands to user .bash_history

Submitted by:  None
Submitted on:  Tue 23 Jun 2015 12:54:57 PM UTC  
 
Category: NoneSeverity: 3 - Normal
Priority: 5 - NormalStatus: Invalid
Privacy: PublicAssigned to: None
Open/Closed: ClosedRelease: 4.2.1
Fixed Release: NonePlanned Release: None
Work Required: None

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Thu 25 Jun 2015 09:32:58 AM UTC, comment #2:

I think we can close this report. This "problem" exist independently from GNU screen.

The workaround in this case will be just reconfigure sudo.

Alexander Naumov <anaumov>
Project Administrator
Thu 25 Jun 2015 04:49:25 AM UTC, comment #1:

It's not screen specific problem, try with
sudo -s
it should have same problem.

you may want to check up your $HISTFILE and how you set it up.

Amadeusz Sławiński <amade>
Project Administrator
Tue 23 Jun 2015 12:54:57 PM UTC, original submission:

If screen is started via sudo, then the bash logs all commands typed by root to the .bash_history file of the user that issued the sudo command. They are then readable by that user.

This is a security issue.

Observed both in the latest commit (d77e2be25149c8593c611bc785e16fc062cb26c4) as well as in Ubuntu 14.04 (Screen version 4.01.00devel (GNU) 2-May-06).

Example:

user@host:/mnt/medium/user/git/screen$ sudo src/screen

[screen is starting]

root@host:/mnt/medium/user/git/screen# echo THIS_IS_SECRET__R_O_O_T__STUFF
THIS_IS_SECRET__R_O_O_T__STUFF
root@host:/mnt/medium/user/git/screen#

[screen is terminating]

user@host:/mnt/medium/user/git/screen$ tail -1 ~/.bash_history
echo THIS_IS_SECRET__R_O_O_T__STUFF

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by anaumov (Posted a comment)
  • -unavailable- added by amade (Posted a comment)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 2 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Thu 25 Jun 2015 09:32:58 AM UTCanaumovOpen/ClosedOpen=>Closed
    Thu 25 Jun 2015 04:49:25 AM UTCamadeStatusNone=>Invalid

    Back to the top


    Powered by Savane 3.1-cleanup1