sudo-rs

I don't think sudo-rs ever advertised itself as a drop in replacement. They seem pretty upfront that it isn't their goal. See this list: https://github.com/trifectatechfoundation/sudo-rs#difference...

I was bummed when I came across this: https://github.com/trifectatechfoundation/sudo-rs/issues/129...

How can you be sure? When I looked at for instance sudo-rs, it proclaimed loudly that it is memory safe, but its code has lots of unsafe. https://github.com/trifectatechfoundation/sudo-rs https://grep.app/search?f.repo=trifectatechfoundation%2Fsudo... And Miri is very popular in Rust. Even if a Rust project doesn't have unsafe, sometimes people still run Miri with it, since dependencies might have messed up their unsafe usage.

> access they shouldn't have It does, quotes from https://github.com/trifectatechfoundation/sudo-rs/security/a... below: > A highly-privileged user (able to run commands as other users, or as root, through sudo) who knows one password of an account they are allowed to run commands as, would be able to run commands as any other account the policy permits them to run commands for, even if they don't know the password for those accounts. > A common instance of this would be that a user can still use their own password to run commands as root (the default behaviour of sudo), effectively negating the intended behaviour of the targetpw or rootpw options.

> Some functionality is not supported, such as […] storing config in LDAP using sudoers.ldap, and cvtsudoers. * https://github.com/trifectatechfoundation/sudo-rs?tab=readme... Well that makes it useless for $WORK (for now), as we use LDAP as our central policy repo (and more generally our user account store). Will have to wait until (at least) that's implemented before we can even consider it. > It's permissively licensed, unfortunately. Wonder why. So it can be used distributed with fewer legal hassles.

Ubuntu is switching to a Rust implementation of sudo: https://www.phoronix.com/news/Ubuntu-25.10-sudo-rs-Default Repo here: https://github.com/trifectatechfoundation/sudo-rs It's permissively licensed, unfortunately. Wonder why. It's not a library. But it ought to improve security in the long run.

A more interesting link is https://github.com/trifectatechfoundation/sudo-rs/issues?q=l... IMO. Glancing down that list, a lot of them aren't what I would personally view as major problems (ex. "rustup is inappropriate for security critical software" - maybe it is, but that's not a specific exploitable bug), but I would suggest https://github.com/trifectatechfoundation/sudo-rs/issues/575 as a potentially interesting looking example. > I apologize, I do not bookmark these issues, but maybe I should start doing that? Yes. If you want to point out problems, it really helps if you can point at specifics. > In any case, you will find logic bugs which may raise the question "is it really worth the rewrite?". There's a cost/benefit question, but note that the mere presence of some bugs doesn't make a rewrite worthless.

> This move is part of a broader effort by Canonical to improve the resilience and maintainability of core system components. Sudo-rs is developed by the Trifecta Tech Foundation (TTF), a nonprofit organization that creates secure, open source building blocks for infrastructure software. Ubuntu continuously updates itself without permission, killing apps and losing previous state. You have the Javascript based Gnome window manager that is always bugging out. The Ubuntu packages, drivers and kernel are laughably behind Debian and even further behind mainline. Ubuntu continues to morph into something I don't believe in. That all said, Rust is not a smoking gun for incorrect application logic. It could still happily incorrectly execute stuff with the wrong permissions or blow something up badly. I think it's also a bad idea to offer it as a

I am pretty sure it is around here somewhere: https://github.com/trifectatechfoundation/sudo-rs/issues. I apologize, I do not bookmark these issues, but maybe I should start doing that? In any case, you will find logic bugs which may raise the question "is it really worth the rewrite?".

1) every dependency comes from crates.io, not straight from GitHub 2) the dependency list is tiny 3) it uses a cargo lock, so even if it were using a GitHub dependency, that file keeps a hash of the dependency and points at the specific commit, so if the dependency were to introduce a backdoor it wouldn't be automatically picked up and a commit history rewrite would also fail https://github.com/trifectatechfoundation/sudo-rs/blob/main/...

There is also a write of sudo in Rust, which works more akin to the traditional sudo but memory-safe and with fewer bugs: https://www.memorysafety.org/blog/sudo-first-stable-release/ Source code: https://github.com/memorysafety/sudo-rs And if you are running Debian 13 (trixie) or later, or Ubuntu 24.04 (Noble Numbat) or later, you can already install it using `apt install sudo-rs`.

It seems like those changes are noted here: https://github.com/memorysafety/sudo-rs#differences-from-ori...

I'm assuming this project's aim is to replace sudo, in which case hand-waving away "Leaving out less commonly used features" is a bit worrying. What are these features? How uncommonly are they used? In which way will it fail if a configuration uses those features? Edit: Looks like their github readme outlines some of these limitations, https://github.com/memorysafety/sudo-rs#differences-from-ori...