Memory-Safe Sudo To Become the Default In Ubuntu 28
Longtime Slashdot reader RoccamOccam shares a blog post from the Trifecta Tech Foundation, a nonprofit organization that creates secure, open source building blocks for infrastructure software. The foundation is also the developer behind Sudo-rs. From the report: Ubuntu 25.10 is set to adopt sudo-rs by default. Sudo-rs is a memory-safe reimplementation of the widely-used sudo utility, written in the Rust programming language. This move is part of a broader effort by Canonical to improve the resilience and maintainability of core system components. [...]
The decision to adopt sudo-rs is in line with Canonical's commitment to Carefully But Purposefully increase the resilience of critical system software, by adopting Rust. Rust is a programming language with strong memory safety guarantees that eliminates many of the vulnerabilities that have historically plagued traditional C-based software. Sudo-rs is part of the Trifecta Tech Foundation's Privilege Boundary initiative, which aims to handle privilege escalation with memory-safe alternatives.
The decision to adopt sudo-rs is in line with Canonical's commitment to Carefully But Purposefully increase the resilience of critical system software, by adopting Rust. Rust is a programming language with strong memory safety guarantees that eliminates many of the vulnerabilities that have historically plagued traditional C-based software. Sudo-rs is part of the Trifecta Tech Foundation's Privilege Boundary initiative, which aims to handle privilege escalation with memory-safe alternatives.
That's cool! (Score:2)
Although I would like sudo that is formally verified, not simply memory safe. Maybe something worth doing in Ada/SPARK.
As long as.... (Score:5, Funny)
...it can still make me a sandwich we're good.
Re: (Score:2)
It's the real sudo's memory unsafety (forgetting how many sandwiches it's made and who for) that allows for this. Don't worry, you can use sudo-rs to run sudo.
Please explain⦠(Score:1)
Could someone explain to a ânon-coderâ(TM) what this means in laymanâ(TM)s terms please. ;)
Re: (Score:3, Insightful)
Someone re-wrote a piece of code that already worked into their preferred language so that they could trumpet their accomplishment.
Re: (Score:2)
Welp (Score:2)
This is probably gonna break some of my 20-year-old plus scripts
Re: Welp (Score:2)
I'm thinking it's in addition to sudo; able to change back to sudo as default
Re: (Score:2)
Meh. The big distros have already deprecated sudo in favor of policykit (which has not yet been re-written in rust).
Re: (Score:1)
Yes, it may break things [github.com], although it's drop-in compatible for the subset of sudo functionality it implements. I'm not sure if Ubuntu will migrate everyone by default on upgrade, but they'll almost certainly keep the original sudo as an option for people that need it.
Great, but ... (Score:2)
Avoiding dangers of dependency explosions (Score:1)
This blog post discusses the risk of depending on dozens of unstable packages, not uncommon for programs written in modern languages:
Sudo-rs dependencies: when less is better [memorysafety.org]
The sudo utility represents a critical privilege boundary, so it should be memory safe. [...] Ruben Nijveld from the Tweede golf team offers his perspective here on one of the greatest challenges we faced when developing software that can be widely adopted: Rust crate dependencies.
When sudo-rs development started, we added several dependencies using Rust's crates ecosystem to quickly ramp up development. During development we accrued approximately 135 transitive (direct and indirect) dependencies. Once this was identified, we managed to reduce our total dependencies down to three. In this blog, we explain why and how we did this.
The remaining dependencies are the core crates libc, glob, and log.
Re: (Score:2)
$ ldd `which sudo-rs`
linux-vdso.so.1 (0x000072fbe0db3000)
libpam.so.0 =>
libgcc_s.so.1 =>
libm.so.6 =>
libc.so.6 =>
Re: (Score:2)
Nice, but that is not what the OP was asking about.
Re: (Score:1)
The immediate implication of my comment is that no "Rust environment" needs to be installed for the sudo-rs executable to function. I guess you could consider statically linked code an "environment", but at any rate it doesn't pull in a bunch of dependencies from the package system that you would get with e.g. a Java or Node application.
Re: (Score:2)
I got two different answers, both useful.
1) For someone who is unfamiliar with Rust, it appears that it can be statically linked to existing libraries. Good ... but that opens up the question of how secure a sudo.rs executable can be if an attack surface exists in someplace like libc.so (the 'old fashioned' C implementation). If I understood this response incorrectly, then:
2) A project to 'Rustify' any existing executable will be an involved job. Here (https://www.memorysafety.org/blog/reducing-dependenci [memorysafety.org]
Is the claim that current sudo is not memory safe? (Score:5, Informative)
Re: (Score:3, Interesting)
It wasn't memory safe in 2021 [mitre.org]. Maybe that was the last latent memory safety problem and no subsequent ones will ever be introduced, but I wouldn't count on it.
Re:Is the claim that current sudo is not memory sa (Score:4, Interesting)
Re: (Score:1)
Yes, "unsafe" code blocks which show up a lot in low level libraries (in this case the standard library) are still subject to memory errors. It's still enormously helpful in practice that most application code (e.g. the ad-hoc string parsing code in the sudo CVE) can be categorically excluded from containing memory errors, leaving a smaller surface area to audit and harden.
Don't care (Score:2)
I use su like god intended.
Re: (Score:2)
So, sudo su me.
made a better doohickey (Score:2)
But why not just get rid of the doohickey completely, and waste less of your time and cognitive ability on something you don't need in the first place.