Add warning about writable directories and sudo/sudoedit.

diff --git a/doc/sudo.cat b/doc/sudo.cat
index 36deb993073ecf89b38476d3635a7c72bd235d9d..e329e7925d520ee2e7d5c8bd6679f49e7a07bd72 100644 (file)
--- a/doc/sudo.cat
+++ b/doc/sudo.cat
@@ -433,6 +433,18 @@ S\bSE\bEC\bCU\bUR\bRI\bIT\bTY\bY N\bNO\bOT\bTE\bES\bS
      environment variable is _\bn_\bo_\bt modified and is passed unchanged to the
      program that s\bsu\bud\bdo\bo executes.
 
+     Users should not be granted s\bsu\bud\bdo\bo privileges to execute files that are
+     writable by the user or that reside in a directory that is writable by
+     the user.  If the user can modify or replace the command there is no way
+     to limit what additional commands they can run.  Likewise, users should
+     not be granted s\bsu\bud\bdo\boe\bed\bdi\bit\bt permission to edit a file that resides in a
+     directory the user has write access to.  A user with directory write
+     access could replace the legitimate file with a link to some other,
+     arbitrary, file.  Starting with version 1.8.15, s\bsu\bud\bdo\boe\bed\bdi\bit\bt will refuse to
+     open a symbolic link unless the security policy explicitly permits it.
+     However, it is still possible to create a hard link if the directory is
+     writable and the link target resides on the same file system.
+
      Please note that s\bsu\bud\bdo\bo will normally only log the command it explicitly
      runs.  If a user runs a command such as sudo su or sudo sh, subsequent
      commands run from that shell are not subject to s\bsu\bud\bdo\bo's security policy.
@@ -592,4 +604,4 @@ D\bDI\bIS\bSC\bCL\bLA\bAI\bIM\bME\bER\bR
      file distributed with s\bsu\bud\bdo\bo or http://www.sudo.ws/license.html for
      complete details.
 
-Sudo 1.8.15                     August 6, 2015                     Sudo 1.8.15
+Sudo 1.8.15                     August 7, 2015                     Sudo 1.8.15

diff --git a/doc/sudo.man.in b/doc/sudo.man.in
index 455e5148a82c5f34f0161866fe02a29cf7e393b2..43e8a877ce125ed1a68090426753acb5f6e1cc2a 100644 (file)
--- a/doc/sudo.man.in
+++ b/doc/sudo.man.in
@@ -21,7 +21,7 @@
 .\" Agency (DARPA) and Air Force Research Laboratory, Air Force
 .\" Materiel Command, USAF, under agreement number F39502-99-1-0512.
 .\"
-.TH "SUDO" "8" "August 6, 2015" "Sudo @PACKAGE_VERSION@" "System Manager's Manual"
+.TH "SUDO" "8" "August 7, 2015" "Sudo @PACKAGE_VERSION@" "System Manager's Manual"
 .nh
 .if n .ad l
 .SH "NAME"
@@ -869,6 +869,25 @@ modified and is passed unchanged to the program that
 \fBsudo\fR
 executes.
 .PP
+Users should not be granted
+\fBsudo\fR
+privileges to execute files that are writable by the user or
+that reside in a directory that is writable by the user.
+If the user can modify or replace the command there is no way
+to limit what additional commands they can run.
+Likewise, users should not be granted
+\fBsudoedit\fR
+permission to edit a file that resides in a directory the user has
+write access to.
+A user with directory write access could replace the legitimate
+file with a link to some other, arbitrary, file.
+Starting with version 1.8.15,
+\fBsudoedit\fR
+will refuse to open a symbolic link unless the security policy
+explicitly permits it.
+However, it is still possible to create a hard link if the directory
+is writable and the link target resides on the same file system.
+.PP
 Please note that
 \fBsudo\fR
 will normally only log the command it explicitly runs.

diff --git a/doc/sudo.mdoc.in b/doc/sudo.mdoc.in
index 89ceee0d611c798878eaefc23411fb1a35e38c8a..119fff9135e80aeffb37e5043a1280a146053184 100644 (file)
--- a/doc/sudo.mdoc.in
+++ b/doc/sudo.mdoc.in
@@ -19,7 +19,7 @@
 .\" Agency (DARPA) and Air Force Research Laboratory, Air Force
 .\" Materiel Command, USAF, under agreement number F39502-99-1-0512.
 .\"
-.Dd August 6, 2015
+.Dd August 7, 2015
 .Dt SUDO @mansectsu@
 .Os Sudo @PACKAGE_VERSION@
 .Sh NAME
@@ -804,6 +804,25 @@ modified and is passed unchanged to the program that
 .Nm
 executes.
 .Pp
+Users should not be granted
+.Nm
+privileges to execute files that are writable by the user or
+that reside in a directory that is writable by the user.
+If the user can modify or replace the command there is no way
+to limit what additional commands they can run.
+Likewise, users should not be granted
+.Nm sudoedit
+permission to edit a file that resides in a directory the user has
+write access to.
+A user with directory write access could replace the legitimate
+file with a link to some other, arbitrary, file.
+Starting with version 1.8.15,
+.Nm sudoedit
+will refuse to open a symbolic link unless the security policy
+explicitly permits it.
+However, it is still possible to create a hard link if the directory
+is writable and the link target resides on the same file system.
+.Pp
 Please note that
 .Nm
 will normally only log the command it explicitly runs.