Hacker News new | ask | show | jobs
by mpyne 4862 days ago
Interesting! Does sudo somehow get confused about checking for a password at all when the current date is the UNIX epoch?

I wonder, does this require the user to be listed in sudoers with any privileges or is it just straight to root?
2 comments
JoachimSchipper 4862 days ago
This gives you only the privileges that a successful "sudo" would give you, and requires a previous successful "sudo". It's a nice hack, but hardly the end of the world.
link
brokentone 4862 days ago
It is, however, the beginning of the UNIX world
link
bluesmoon 4862 days ago
the user does have to be listed in sudoers.

there's no confusion with sudo, it's running as designed. It compares the current timestamp to the user timestamp to determine whether to ask for a password or not. The first flaw is in the date command allowing unprivileged users to set the time. The second is that the -K flag to sudo makes the -k flag obsolete, so the latter should be dropped.

link