Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-92633

ksh reports /usr/bin/ksh as "$0" instead of script name, when script executes under sudo + checksum verification

Linking RHIVOS CVEs to...Migration: Automation ...SWIFT: POC ConversionSync from "Extern...XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Unresolved
    • Icon: Blocker Blocker
    • rhel-10.2
    • rhel-8.10, rhel-9.6, rhel-10.0
    • ksh
    • None
    • No
    • Moderate
    • rhel-jotnar
    • ssg_core_services
    • 3
    • False
    • False
    • Hide

      None

      Show
      None
    • None
    • Red Hat Enterprise Linux
    • None
    • None
    • None
    • Unspecified
    • Unspecified
    • Unspecified
    • None

      When executing a ksh script under sudo and sudo has a line to verify the checksum, then the $0 is reported as /usr/bin/ksh instead of script being interpreted:

      ksh script /usr/local/bin/script.ksh

      #!/usr/bin/ksh
      echo "\$0: $0"
      

      configure sudo to verify the checksum

      # echo "kshuser ALL=NOPASSWD: sha256:$(sha256sum /usr/local/bin/script.ksh)" > /etc/sudoers.d/kshuser
      

      execute the script under sudo

      (kshuser) $ sudo /usr/local/bin/script.ksh
      $0: /usr/bin/ksh
      

      The root cause is likely due to having a execveat() being used by sudo to execute the script, instead of "regular" execve(), as seen with stracing:

      5129  11:25:59.445250 execve("/usr/bin/sudo", ["sudo", "/usr/local/bin/script.ksh"], ...
       :
      5131  11:25:59.489322 execveat(6</usr/local/bin/script.ksh>, "", ["/usr/local/bin/script.ksh"], ..., AT_EMPTY_PATH) = 0
      

      The execveat() is done on purpose to make sure the script was not altered.

      Due to this bug, it's impossible to know which script is currently executing.

              jotnar-project Jötnar Project
              rhn-support-rmetrich Renaud Métrich
              Vincent Mihalkovic Vincent Mihalkovic
              Jötnar Project Jötnar Project
              Votes:
              0 Vote for this issue
              Watchers:
              13 Start watching this issue

                Created:
                Updated: