lostutils / suex Goto Github PK
View Code? Open in Web Editor NEWexecute commands as another user
License: MIT License
execute commands as another user
License: MIT License
I believe that asciinema is the best way to go.
Many code paths check that a file exists and then reads it.
There's a small window that allows an attacker to replace the file between these calls.
When more than one blank is used to separate the entries of a line in the configuration file (e.g. to make it look more neat or clearly formatted) the configuration file is invalid.
Wouldn't it be better to allow any kind of whitespace as delimiter between the components of a line?
Thoughts - should we switch to clang?
Does it cause a conflict if the username is identical to the group?
We have a group with some developers working on a service plus a generic account under which the service is running. The generic account has the same name as the group.
Problem description:
The following group configuration entry is in suex.conf.
permit nopass :foo as root cmd /usr/bin/systemctl args (status|restart|stop|start) nginx.service
It works for all members of the group, but not for the generic account foo .
% id
uid=316(foo) gid=253(foo) groups=253(foo),110(a),120(b),122(c),126(d),230(e),248(f),254(g),908(h)
% suex systemctl status nginx.service
You are not allowed to execute '/usr/bin/systemctl status nginx.service' as root
I have to add an additional username based configuration entry for foo to enable it as well:
permit nopass foo as root cmd /usr/bin/systemctl args (status|restart|stop|start) nginx.service
Only with this additional entry foo can suex the command, too.
suex
forbids multiple instances from editing the configuration file.
The mechanism is a simple lock file that was created for this purpose.
We need to replace this ad-hoc
solution with a proper locking mechanism.
Further reading: File locking in Linux
There’s no input validation. Specifically when loading the configuration.
todo:
Currently the code is coupled to linux.
Add the infastracture needed to support other operation systems
I'd do it if I knew how, I might look into it tonight, but this would be very helpful.
thank you for all the hard work man.
Various users pointed out that the name doas conflicts with other projects and causes confusion.
Examples are key to show the power of the project,
and help new users set up quickly
suex
is missing an audit feature that'll give sysadmins insights into suex
usage.
For example:
I believe that this information can be sent using rsyslog
.
Things to point out:
When trying to edit doas.conf, it always fails to parse the command, despite them being valid:
DEBUG - parsing line 1: '# Welcome to doas!'
DEBUG - line 1 is a comment, skipping.
DEBUG - parsing line 2: 'permit persist :wheel'
DEBUG - couldn't parse: permit persist :wheel
ERROR - line invalid
RE2 is Google's take on regex engines.
IMO, it's api is a bit cumbersome compared to std::regex
but its considered safer then std::regex
(which, as far as I know, based on boost::regex
).
From WhyRE2:
Safety is RE2's raison d'être.
RE2 was designed and implemented with an explicit goal of being able to handle regular expressions from untrusted users without risk...
suex follow links by default which causes issues when the target app uses the link to figure out which toggles to use.
for example, kmod
uses the symbolic links lsmod
,rmmod
,insmod
, etc' to do its magic.
Because suex follow links we get an unexpected behavior -
$ suex -V modprobe vboxdrv
DEBUG - Y .+ ~= /usr/bin/kmod vboxdrv
instead of:
$ suex -V modprobe vboxdrv
DEBUG - Y .+ ~= /usr/sbin/modprobe
Solution: instead of following links, use the absolute path.
Tests are crucial for a healthy, working, project.
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.