Support su for root privilege escalation

[E-M]

Is sudo the only option for root privilege escalation? We don't use sudo (we cannot even run it), we use other method (similar to su) and because sudo is hardcoded vuls scan fails.

[kotakanbe]

Hi, @E-M
Please tell me the details of your method for root privilege escalation.
Thanks.

[E-M]

Basically it is just like su, you run command like:
su -c "some_command"

The problem is not that you don't support su or other method, the problem is that you have hardcoded sudo.

[sadayuki-matsuno]

@E-M
Sorry for being late.
I have a question.
Are you okey if you use su method(instead of sudo) without password?

[kotakanbe]

--ask-sudo-password was deleted for security reasons.
Because plain sudo password have to be passed via pipe in shell.
The same can be said about su.

So, Vuls supports sudo + NOPASSWD in /etc/sudoers on the target server for now. ( see https://github.com/future-architect/vuls#usage-configtest section)