Explicitly tell people not to grant sudoedit to directories the

user can write to.  While sudoedit will no longer open symbolic
links, hard links are still an issue.

diff --git a/doc/sudoers.cat b/doc/sudoers.cat
index ae7c8a95bf1876357c2dcd591b83ede518b5e0a5..fca92d33130cf7aff57904687dbcb9adc587b0ac 100644 (file)
--- a/doc/sudoers.cat
+++ b/doc/sudoers.cat
@@ -2310,6 +2310,17 @@ S\bSE\bEC\bCU\bUR\bRI\bIT\bTY\bY N\bNO\bOT\bTE\bES\bS
      of _\b/_\be_\bt_\bc_\b/_\bm_\bo_\bt_\bd.  After the file has been edited, _\b/_\be_\bt_\bc_\b/_\bm_\bo_\bt_\bd will be updated
      with the contents of the temporary copy.
 
+     Users should never be granted s\bsu\bud\bdo\boe\bed\bdi\bit\bt permission to edit a file that
+     resides in a directory the user has write access to, either directly or
+     via a wildcard.  If the user has write access to the directory it is
+     possible to replace the legitimate file with a link to another file,
+     allowing the editing of arbitrary files.  Starting with version 1.8.15,
+     s\bsu\bud\bdo\boe\bed\bdi\bit\bt will refuse to open a symbolic link unless either the
+     _\bs_\bu_\bd_\bo_\be_\bd_\bi_\bt_\b__\bf_\bo_\bl_\bl_\bo_\bw Defaults option is enabled or the _\bs_\bu_\bd_\bo_\be_\bd_\bi_\bt command is
+     prefixed with the FOLLOW tag.  However, it is still possible to create a
+     hard link if the directory is writable and the link target resides on the
+     same file system.
+
    T\bTi\bim\bme\be s\bst\bta\bam\bmp\bp f\bfi\bil\ble\be c\bch\bhe\bec\bck\bks\bs
      _\bs_\bu_\bd_\bo_\be_\br_\bs will check the ownership of its time stamp directory
      (_\b/_\bv_\ba_\br_\b/_\br_\bu_\bn_\b/_\bs_\bu_\bd_\bo_\b/_\bt_\bs by default) and ignore the directory's contents if it

diff --git a/doc/sudoers.man.in b/doc/sudoers.man.in
index 3ea41689f31067262c694972679c2baa5e60f515..aee2c3a3abb0e2fa977fba05e38dbee00d2580f1 100644 (file)
--- a/doc/sudoers.man.in
+++ b/doc/sudoers.man.in
@@ -4724,6 +4724,25 @@ The editor will run as the operator user, not root, on a temporary copy of
 After the file has been edited,
 \fI/etc/motd\fR
 will be updated with the contents of the temporary copy.
+.PP
+Users should never be granted
+\fBsudoedit\fR
+permission to edit a file that resides in a directory the user
+has write access to, either directly or via a wildcard.
+If the user has write access to the directory it is possible to
+replace the legitimate file with a link to another file,
+allowing the editing of arbitrary files.
+Starting with version 1.8.15,
+\fBsudoedit\fR
+will refuse to open a symbolic link unless either the
+\fIsudoedit_follow\fR
+Defaults option is enabled or the
+\fIsudoedit\fR
+command is prefixed with the
+\fRFOLLOW\fR
+tag.
+However, it is still possible to create a hard link if the directory
+is writable and the link target resides on the same file system.
 .SS "Time stamp file checks"
 \fIsudoers\fR
 will check the ownership of its time stamp directory

diff --git a/doc/sudoers.mdoc.in b/doc/sudoers.mdoc.in
index e704dd328b6d3e423a79608cff0d97129f8b213e..ca1ae19630651dca10bbde2e5bfb10711b77f320 100644 (file)
--- a/doc/sudoers.mdoc.in
+++ b/doc/sudoers.mdoc.in
@@ -4356,6 +4356,25 @@ The editor will run as the operator user, not root, on a temporary copy of
 After the file has been edited,
 .Pa /etc/motd
 will be updated with the contents of the temporary copy.
+.Pp
+Users should never be granted
+.Nm sudoedit
+permission to edit a file that resides in a directory the user
+has write access to, either directly or via a wildcard.
+If the user has write access to the directory it is possible to
+replace the legitimate file with a link to another file,
+allowing the editing of arbitrary files.
+Starting with version 1.8.15,
+.Nm sudoedit
+will refuse to open a symbolic link unless either the
+.Em sudoedit_follow
+Defaults option is enabled or the
+.Em sudoedit
+command is prefixed with the
+.Li FOLLOW
+tag.
+However, it is still possible to create a hard link if the directory
+is writable and the link target resides on the same file system.
 .Ss Time stamp file checks
 .Em sudoers
 will check the ownership of its time stamp directory