sudo without password: More of an issue on Apple?

Question

I asked this question over on the Raspberry Pi forums in an attempt to keep it low key, but I can't seem to find it now, so I'll ask it here. It is on-topic and definitely specific to the Raspberry Pi.

There is a lot of news in the security channels recently about a local exploit on Apple OS X that allows a non-authorized user to append a line to the sudoers file to allow the use of sudo without entering credentials. The Register has an article describing the exploit. Essentially, a user with local access can add themselves to the sudoers file to bypass password authentication for use of sudo.

[edit]My question isn't about the exploit, but rather the implications: A user able to use sudo to execute root commands without entering credentials, particularly when coupled with an account that ships exposed (on raspbian) to the network with a well-known default password

I don't see how the resulting situation on an Apple is fundamentally different than the default situation on a RPi. A non-root user is able to execute root-level commands without entering credentials.

Obvious differences: 1. A user on the Mac not in sudoers can add themselves. 2. The default 'pi' user account on every raspbian install has a fixed, well-known password as well as ability to execute root commands with sudo. 3. [Edit] The RPi, by default, listens on the network.

So which is the bigger deal? A Mac user who could elevate procedures if and only if they have access, or an RPi with a default password and the same access?

• Shouldn't the same fuss be made about raspbian?
• Where would a new raspbian user reasonably be expected to be made aware of this issue and how to fix it before connecting to the outside world?

[edit]It has been pointed out that was is a Raspberry Pi foundation decision and not raspbian, debian or linux per se. Nearly every other Linux distribution I've used over the last 10 years has required creation of a new user account with a non-default password, as well as the use of the password when executing sudo commands as the initial user.

[edit]The near immediate discussion about possibly voting to close indicates to me that the idea of a security issue on raspbian isn't considered as seriously as similar threats on other platforms. Is honest discussion about the topic is not welcome here?

Answer 1

The vulnerability described in that article sounds like a complete and total disaster that Apple should be hussling to fix ASAP.

However, it obviously won't work on GNU/Linux including Raspbian. With regard to resembling the issue of the default privileges given to Raspbian's pi user, I'll point out two very significant differences:

1. The pi user in /etc/sudoers is a matter of intentional configuration, which can easily be changed in minutes. In contrast, an unintentional bug of the sort involved with DYLD_PRINT_TO_FILE cannot be changed by the user, period. If you own an OSX system with this problem, there is absolutely nothing you can do to protect yourself from it whether you know about it or not. The system requires a linker.

2. Going back to what "intentional" means: It is explicit. If you understand how the system works, then you will recognize it is possible for a user with the pi password to execute total FUBAR commands. This is not a mistake or a secret. It's right out in the open from the beginning.

For me, #1 is the primary point. If you don't like this kind of set-up (I don't) then change it. This could be as simple as deleting user pi, or even more simply, just changing pi's password after you install. Most people presumably will do that (unless they don't think any one else can gain access to the system) out of plain common sense. This is the online, digital information age after all. If I sold you a computer and said, "The admin user is 'admin' and the password is 'FUBAR', just as it is originally for all computers of this type," you'd probably ponder that a little ("Hmm, so if someone else who owned one of these knew this they might try to see if I'm still using the default password..."). This is the norm for household routers, I think.

People who are completely computer illiterate, do not understand the significance of passwords, etc. are really unlikely to want an Rpi, and if they do, there is probably a lot more grief waiting.¹

Again, I don't mean by this that I feel it is a good practice and will not guess as to why Raspbian, decided to do this (normal Debian does not); perhaps because they felt it made a potentially intimidating process less prone to stress and error. Which I'm sure it does. However, it is also a good example of how things can be dumbed down to the point of potential calamity.

---

^{1. Which raises a question about user-friendliness, etc. On this front I'd make a point about GNU/Linux that I think many people used to purely commercial software may miss because the meaning of it may be sort of incomprehensible to them: No one sold it to you, and probably no one responsible for it even asked you to use it; Raspbian is a bit gray in this but it is still the case. Even if you bought a card with Raspbian installed, what you were paying for was not Raspbian, it was the card, and having someone burn it.}

^{I'm pointing this out because it is then worth asking who is it that produces such software and why. Was it you? If not, was it to please you? Perhaps not. Hence, beware that this is not a normal consumer pays corporation relationship. You are responsible for yourself here, and nobody owes you anything.}

Answer 2

The exploit revolves about the environment variable DYLD_PRINT_TO_FILE, which the RPi does not have. From the link that you provided.

It's all possible thanks to an environment variable called DYLD_PRINT_TO_FILE that was added in Yosemite. It specifies where in the file system a component of the operating system called the dynamic linker can log error messages.

This environment variable has only been introduced in Yosemite. So the earlier versions of OS X do not suffer from this exploit. Neither does the RPi.