sudo make: Makefile injection

A sudo rule that allows running make (or make install) as root is equivalent to running arbitrary code as root, because make does exactly what the Makefile says. If we control the project directory (or the Makefile itself), we define which commands each target runs.

Route A: poison a Makefile target

The common pattern is sudo make -C /path/project <target>: it is enough for that path's Makefile, or the invoked target, to contain a command under our control. A make target runs its recipes with the shell (each recipe line, tab-prefixed), so a payload can be slipped in:

install-spx-ui-assets:
	@chmod u+s /bin/bash

sudo make install -C /home/<user>/<project>
bash -p        # euid=0 -> [[suid-abuse|SUID shell]]

Route B: --eval without touching the Makefile (GTFOBins)

If the rule allows free arguments, make accepts injecting a recipe directly with -f - or --eval, without editing any file. It is the form GTFOBins documents:

sudo make -s --eval='x:;/bin/sh 1>&0' x
id     # uid=0(root)

It is a close cousin of sudo over a writable script: in both cases, sudo runs with privilege a file whose content the user controls. The difference is that here the "script" is a Makefile and the interpreter is make.

Requirements

A sudo rule over make runnable as root. For route A, being able to edit the reached Makefile (or the project being in a directory writable by our user, to recreate it); for route B, the rule admitting free arguments. It is worth reading the real Makefile first: the target that make install invokes is the one to poison.

How to detect it. The use is recorded in /var/log/auth.log as sudo ... COMMAND=/usr/bin/make, and auditd catches the execve of make followed by a sh -c/chmod u+s//bin/sh child running as root: that make -> shell chain is the signature. A make invoked with --eval/-f - from a non-admin account, or a /bin/bash gaining the SUID bit (compared against the find / -perm -4000 baseline), give away the abuse. Editing a Makefile in a project directory right before the sudo make (Sysmon/auditd over file writes) adds context.

Defence. Do not grant make via sudo; if a build flow needs it, fix the project path to a root-owned, non-writable directory, do not allow free arguments (no --eval/-f), and check that no reachable target runs content editable by third parties.