secured environment for output generation about peaas HOT 6 OPEN

你們在執行外部命名時，原本是以 www-data 執行 cmd arg ....
現在改為
/usr/bin/sudo /bin/su penobody -c cmd arg ...

這樣就以 penobody 的權限執行，就無法動到 www-data 的檔案。

from peaas.

另外有關 security ，另外解法是 linux control group, 用 cgexec. 我們後續可慢慢學。

from peaas.

you may also consider using

/usr/bin/sudo -u penobody cmd args

from peaas.

it is restricted in /etc/sudoers with NOPASSWD for /bin/su penobody -c. Is it possible to limit sudo -u penobody without password ? the command launched by www-data is from web applications.

from peaas.

Sure, a simple example

www-data    ALL = (penobody) NOPASSWD: /usr/bin/cmdA, /usr/bin/cmdB, /usr/bin/cmdC

User www-data can run cmdA, cmdB and cmdC as user penobody without authentication on any hosts.

from peaas.

It is a better solution. We need the whitelist of cmdA,B,C. Another concern is that the command executed may create a backdoor to other sites. (I just restrict outgoing connection)

from peaas.