drop privileges more thoroughly about duo_unix HOT 3 CLOSED

Actually, seems as if it isn't actually that bad because processes in the context of the DUO_PRIVSEP_USER will be protected from ptrace or so because they once were setuid and so, they're still non-dumpable (at least on Linux).

from duo_unix.

For setuid binaries, the supplementary groups that exist after dropping privileges (like login_duo does) will be the same as the original user that executed the binary. So, there's not really a "local" risk (that is, a risk of an attacker invoking login_duo for purposes of privilege escalation on a box). There is a small remote risk if an attacker was able to MITM the connection and reach the minimal attack surface represented by the HTTP layer.

from duo_unix.

Closing out this old issue

from duo_unix.