Skip to content

Default use of 'less' is a security concern #5666

@stvhay

Description

@stvhay

Submission type

  • Bug report
  • Request for enhancement (RFE)

NOTE: Do not submit anything other than bug reports or RFEs via the issue tracker!

systemd version the issue has been seen with

ALL

NOTE: Do not submit bug reports about anything but the two most recently released systemd versions upstream!

Used distribution

ALL

In case of bug report: Expected behaviour you didn't see

adding this to sudoers: "%manager ALL=(root) NOPASSWD: /bin/systemctl status" would not provide a path to root shell

In case of bug report: Unexpected behaviour you saw

once the pager (less) is invoked, !/bin/bash drops you to root shell.

In case of bug report: Steps to reproduce the problem

(covered above)

I realize that this can be addressed by adding the --no-pager option and creating aliases, but is sure seems like invoking a pager that lets you drop shell on a utility run as root is just begging for trouble.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions