The world seems so loopy. But at least someone's written a memory-safe sudo in Rust
- Reference: 1693652109
- News link: https://www.theregister.co.uk/2023/09/02/isrg_prossimo_sudo_rs/
- Source link:
Prossimo, a project overseen by the non-profit Internet Security Research Group (ISRG), [1]announced the first stable release of [2]sudo-rs this week. That open source codebase includes the related [3]su command-line program, again in Rust.
The sudo utility provides a way for privileged users of Unix-like systems (eg: Linux and FreeBSD) to run a command as root. It presents a bit of a risk in that low-privileged rogue users or software could find a way to abuse it, such as by exploiting a bug in the code, to elevate their access to root, or superuser, level. Ideally sudo and su should be as secure and vulnerability-free as possible, as they act as gateways to taking full control of a system.
[4]
Memory safety bugs include issues like out-of-bounds reads and writes, and use-after-free(). And some of these exploitable vulnerabilities have been [5]found in sudo.
[6]
[7]
According to Josh Aas, executive director of ISRG's Prossimo project, one out of three of the security bugs in the original sudo stem from memory management issues.
"The first stable release of sudo-rs, our rewrite of the critical sudo tool in Rust, is an important milestone," said Aas in an email to The Register .
We're seeing interest from Linux distros and hopefully that will make the security improvements available to many more people
"People can start using it to achieve greater security through memory safety, reduced attack surface, and extensive testing. We're seeing interest from Linux distros and hopefully that will make the security improvements available to many more people."
Aas said the next step is a third-party security audit. "We're seeking additional funding for work on enterprise features and hardening," he said.
[8]
Rewriting sudo in Rust should eliminate the potential for memory-safety bugs, which have become [9]a matter of widespread concern in the past few years among technology companies and US government agencies, at least. These flaws can be exploited to hijack apps or systems, and steal data, among other things. They can also be used to infiltrate software supply chains.
Most modern programming languages, in one way or another, allow developers to write code in a way that's memory safe, and Rust is particularly well-suited for the task. Non-safe programming languages [10]include C, C++, and assembly. However, C++ creator Bjarne Stroustrup previously [11]told The Register that ISO compliant C++, with the help of a static analyzer, can be safe too – a claim about which Aas previously expressed skepticism.
[12]Microsoft is busy rewriting core Windows code in memory-safe Rust
[13]This profiler chatbot promises to help speed up your Python – we can believe it
[14]Rust Foundation so sorry for scaring the C out of you with trademark crackdown talk
[15]Fed up with Python setup and packaging? Try a shot of Rye
The sudo-rs revision, Aas said in a [16]blog post , omits less commonly used features to reduce the attack surface of the software. It has also led to the development of [17]a test suite that has helped spot bugs in the original C implementation, created around 1980 by Bob Coggeshall and Cliff Spencer from SUNY/Buffalo and presently [18]maintained by Todd Miller.
Chainguard, which makes a container-focused Linux distribution called [19]Wolfi , has incorporated sudo-rs into its images.
"The sudo utility is a perfect example of a security-critical tool that's both pervasive and under-appreciated," said Dan Lorenc, CEO and co-founder at Chainguard, in a statement. "Security improvements to tools like this will have an outsized impact on the entire industry."
[20]
Work on the sudo rewrite began in December 2022, a month after the US National Security Agency [21]published guidance urging organizations to adopt memory safe languages. The federal signals intelligence agency notes that Google and Microsoft have each said about 70 percent of the vulnerabilities they deal with arise from memory safety bugs.
"Memory management issues have been exploited for decades and are still entirely too common today," said Neal Ziring, cybersecurity technical director for the NSA, in a statement at the time. "We have to consistently use memory safe languages and other protections when developing software to eliminate these weaknesses from malicious cyber actors."
Last month, the White House [22]issued a [23]Request for Information [PDF] soliciting opinions on open-source software security and memory safe programming languages. Comments must be submitted by 1700 ET on October 9. ®
Get our [24]Tech Resources
[1] https://www.memorysafety.org/blog/sudo-first-stable-release/
[2] https://github.com/memorysafety/sudo-rs
[3] https://documentation.suse.com/smart/systems-management/html/concept-sudo/index.html
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZPNcItjH2hWds0bXTWfEggAAAYs&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[5] https://www.sudo.ws/security/advisories/unescape_overflow/
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZPNcItjH2hWds0bXTWfEggAAAYs&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZPNcItjH2hWds0bXTWfEggAAAYs&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZPNcItjH2hWds0bXTWfEggAAAYs&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[9] https://www.theregister.com/2023/01/26/memory_safety_mainstream/
[10] https://www.memorysafety.org/docs/memory-safety/
[11] https://www.theregister.com/2022/09/20/rust_microsoft_c/
[12] https://www.theregister.com/2023/04/27/microsoft_windows_rust/
[13] https://www.theregister.com/2023/08/30/scalene_ai_advice_python/
[14] https://www.theregister.com/2023/04/17/rust_foundation_apologizes_trademark_policy/
[15] https://www.theregister.com/2023/05/04/a_python_tool_called_rye/
[16] https://www.memorysafety.org/blog/sudo-first-stable-release/
[17] https://ferrous-systems.com/blog/testing-sudo-rs/
[18] https://www.sudo.ws/
[19] https://www.chainguard.dev/unchained/introducing-wolfi-the-first-linux-un-distro
[20] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZPNcItjH2hWds0bXTWfEggAAAYs&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[21] https://www.nsa.gov/Press-Room/News-Highlights/Article/Article/3215760/nsa-releases-guidance-on-how-to-protect-against-software-memory-safety-issues/
[22] https://www.whitehouse.gov/oncd/briefing-room/2023/08/10/fact-sheet-office-of-the-national-cyber-director-requests-public-comment-on-open-source-software-security-and-memory-safe-programming-languages/
[23] https://www.whitehouse.gov/wp-content/uploads/2023/08/OS3I-RFI-Embargoed-Until-08102023-0500EST.pdf
[24] https://whitepapers.theregister.com/
Re: Mandate
Full disclosure: I used to code extensively in C and C++, currently in Java, and I'm learning Rust.
The trouble with Java and C# is that they use garbage collection, and if that was retained as part of the runtime support for a natively compiled implementation, then it has important implications for performance. It also impacts the ability to do anything approaching real time work with them. There are a few Java implementations that target embedded devices, but they tend to insist on some very strict limitations on how and when objects are created.
I'm a bit ambivalent about Rust right now. It's just a bit too different in a number of areas from what I've used before, not just in it's memory management features. There again, that may be more of a reflection of how thick I am, and it still feels a lot simpler than many C++ features - particularly the template metaprogramming that was all the rage a few years ago.
Re: Mandate
I program in aforementioned languages too (replace Java with C# in my case) and I can tell you that garbage collection latency is not an issue in MOST cases, especially ones where things happen on human time-scales.
Rust was only invented for performance critical and systems programming, although just like C/C++ more and more people are using it for general purpose programming.
Re: Mandate
There is some considerable progress on [1]ahead of time native compilation of .NET applications.
However, there's a danger of comparing apples and oranges. Unlike Rust, .NET relies quite heavily on reflection (the ability to retrieve information about objects, types, interfaces and their attributes at runtime) and a lot of popular .NET techologies (like Entity Framework and ASP.NET) use it to wire everything up at runtime. This means that a "typical" .NET program is carrying more baggage in the runtime, which as the present goal is for all the code you need to be in the single executable file can make it quite big. There's also presently no GUI support.
However, you ought to be able to write command-line utilities in .NET Native now that are roughly comparable to something you might write in Rust.
[1] https://learn.microsoft.com/en-us/dotnet/core/deploying/native-aot/?
Re: Mandate
If Microsoft had taken into account native compilation for C# this wouldn't have happened. They blindly copied Java and didn't see C# as a replacement for C and C++ (Microsoft was and still is a C++ stronghold).
The world would look completely different if they had. There wouldn't have been such a strong case for Rust, since manual memory management is a standard feature in C#, but one which no one uses. You can mix and match it with garbage collection, which is a much programmer friendlier solution than Rust. Although Rust has some modern constructs like monads and Typed structs.
Re: Mandate
Also, Microsoft's effort on AOT compilation is too little, too late. They've been working on it for years and years and it still only compiles a small subset of .NET programs. And even then with many caveats.
Re: Mandate
The Sappeur language is as close to C++ as possible while memory safe. Key C++, concepts are retained.
Re: Mandate
> How long before the U.S. government mandates that all its software be written in
As soon as ADA conversion is complete ;)
LuaJIT v2.x
I used to do a lot of work with a JIT compiler for Lua. This thing could produce phenomenally fast native code *and* it had a powerful FFI (of course, this was not a memory-safe area, very much like unsafe for Rust). Alas, the garbage collector made it very hard to write code that guaranteed a certain performance. There were some tricks to mitigate this and Mike Pall, the author of LuaJIT, had plans for a better garbage collection implementation but these never materialised. Even today, to hack together a quick utility I am more likely to use LuaJIT than Python.
ARC
Semi-realtime GUI Performance is best achieved using ARC. In Sappeur, all pointers are ARC Smart Pointers.
Perhaps /etc/sudoers more of a problem than perhaps C memory safety
The syntax and semantics of sudo's configuration file(s) are not always entirely clear or obvious. I suspect more unintended access arises from misconfiguration than from memory safetly issues.
Still (re)writing privileged code in a memory safe language has to be applauded. A garbage collected language (Go?) would be fine for something like sudo, I would imagine.
I think...
$ sudo make me a sandwich
...will fail when it is created with iron oxide.
Can we please stop fetishising rust whilst conflating C++ with C?
Rust: an unwanted emission with poor tooling from a source with a dreadful record in good language design. Appalling choices from a syntactic perspective and an unknowable runtime. Should have done much better.
And C != C++. Writing code in the latter language is more simply saving your code with a.cpp extension. Indeed, this has been the case since the previous millennium.
Mandate
How long before the U.S. government mandates that all its software be written in a secure programming language? I mean, Java has been available for almost 30 years and C# for more than 20.
If Microsoft and Sun had compiled C# and Java native code instead of a virtual machine I believe there would be little demand for a language like Rust. Alas, that ship has sailed and during the last two decades many people have attempted to modify or add extensions to C / C++ or came up with newer languages to make systems programming safer. None of those really solved the problem or took off. Rust is the only effort that seems to have a substantial following