sudo and OpenDoas timestamp files (2020)

In 2020, the developers of OpenBSD introduced a new tty(4) ioctl(2) in the doas(1) utility, which enabled the creation, clearing, and checking of authentications for specific TTYs with a timeout. This feature aimed to enhance security and user experience by eliminating the need for repeated password entries. However, the implementation of timestamp files, similar to those used by sudo(8), raised concerns about potential security risks.

The timestamp files in sudo(8) were vulnerable to reuse, as a proof-of-concept demonstration showed how an attacker could authenticate themselves using ssh and subsequently execute sudo(8) without providing a password. To replicate the PPID (Parent process identifier) of the sshd sub-process, the attacker would call clone(2) in a loop, which would allow them to reuse the timestamp file and execute sudo(8) without needing to enter a password.

To mitigate this issue, the OpenDoas developers proposed the use of the start time of a TTY session leader as a unique identifier. This start time is a monotonic clock that can only move forward from the time of system boot. By verifying this start time, it would be nearly impossible to replicate the same TTY/PPID combination with the same session leader start time, thus preventing unauthorized access.

The developers implemented this security measure in OpenDoas and recommended that the sudo(8) maintainers adopt the same mechanism to enhance overall security. Within a few hours, the new feature was integrated into sudo(8), and it was released as version 1.8.22 in 2017. This updated version was no longer limited to Linux, but offered the improved security feature to all supported operating systems.