Is setting a sudo time limit to 0 seconds still required for secure macOS operations?

Question

I am used to set

Default timestamp_timeout=0

in /etc/sudoers via the visudo command when configuring a new macOS. The reason originally was that applications can start shell scripts and it used to be that an application constantly trying to run sudo in the background would be able to hijack the lingering sudo credentials (because it spawned the same TTY if I recall correctly) and get root access (ugh). Hence, I always set the timeout to 0 so I have to enter the password for every sudo command. Which is a pain, but more secure.

However, if that particular road has been closed, I could maybe make life a bit more comfortable by setting it to a fraction of a minute. Can I? Or is it still a security risk, something that can be hijacked?

Answer 1

Before Mac OS X Sierra, the sudo configuration did not enable the tty_tickets options. That meant that the credentials were cached and accessible by any tty.

Since Mac OS X Sierra, tty_tickets is enabled by defaults, meaning that the credentials are only cached for a specific tty - thereby disabled this set of exploits (i.e. monitoring /var/db/sudo and trying to exploit sudo within the timeout).

I think your memory is a bit fuzzy regarding spawning the same tty, as the problem was really as described above.

Mac OS X Sierra was released in 2016, so for the last 5 years, users of the latest operating system version have been safe here.

In terms of security risks in general, you should note that there is (ofcourse) always less risk involved in having no cached credentials (i.e. timestamp_timeout=0). It has to be balanced with user comfort, as there are also drawbacks associated with having to enter a password many times a day (when using password based credentials).