Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-92633

ksh reports /usr/bin/ksh as "$0" instead of script name, when script executes under sudo + checksum verification

Linking RHIVOS CVEs to...Migration: Automation ...SWIFT: POC ConversionSync from "Extern...XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Unresolved
    • Icon: Blocker Blocker
    • rhel-10.2
    • rhel-8.10, rhel-9.6, rhel-10.0
    • ksh
    • No
    • Moderate
    • rhel-plumbers
    • ssg_core_services
    • 3
    • False
    • False
    • Hide

      None

      Show
      None
    • None
    • Red Hat Enterprise Linux
    • None
    • None
    • None
    • Unspecified
    • Unspecified
    • Unspecified
    • None

      When executing a ksh script under sudo and sudo has a line to verify the checksum, then the $0 is reported as /usr/bin/ksh instead of script being interpreted:

      ksh script /usr/local/bin/script.ksh

      #!/usr/bin/ksh
      echo "\$0: $0"
      

      configure sudo to verify the checksum

      # echo "kshuser ALL=NOPASSWD: sha256:$(sha256sum /usr/local/bin/script.ksh)" > /etc/sudoers.d/kshuser
      

      execute the script under sudo

      (kshuser) $ sudo /usr/local/bin/script.ksh
      $0: /usr/bin/ksh
      

      The root cause is likely due to having a execveat() being used by sudo to execute the script, instead of "regular" execve(), as seen with stracing:

      5129  11:25:59.445250 execve("/usr/bin/sudo", ["sudo", "/usr/local/bin/script.ksh"], ...
       :
      5131  11:25:59.489322 execveat(6</usr/local/bin/script.ksh>, "", ["/usr/local/bin/script.ksh"], ..., AT_EMPTY_PATH) = 0
      

      The execveat() is done on purpose to make sure the script was not altered.

      Due to this bug, it's impossible to know which script is currently executing.

              vmihalko Vincent Mihalkovic
              rhn-support-rmetrich Renaud Métrich
              Vincent Mihalkovic Vincent Mihalkovic
              Karel Volný Karel Volný
              Votes:
              0 Vote for this issue
              Watchers:
              13 Start watching this issue

                Created:
                Updated: