Re: sudo

On Fri, Apr 3, 2015 at 6:48 PM, Scott Moore <[email protected]> wrote:
> On Fri, Apr 3, 2015 at 4:34 PM, Raoul Duke <[email protected]> wrote:
>> I have nothing new to say, I just wanted to vent.

I'm right there with you...

>> every! time! i! type! sudo <anything>! i! want! to! scream!

For me, it's chmod / chown especially.

I'm forever trying to give jenkins (a ci tool that we use for
deployment as well) just enough privilege to do its job.

Here's a puzzle: Bob wants to share one of his directories with Alice
so both of them can write to it but nobody else can.

The only solution(s) I can see involve root access, not to mention the
global namespace of group names:
 - make a new group BA
 - add Bob and Alice to BA
 - chgrp BA shared_dir
 - chmod g+w shared_dir

> We've been working on this too at shill-lang.org.

I read the shill paper last Sep... good stuff. I wonder if it would
help with the puzzle above.

I've been playing with a sort of signed javascript approach, using a
javascript interpreter in go: https://github.com/robertkrimen/otto


The way it works is:

0. There's a host key that only root can read for granting attenuated
filesystem access on that host.

1. Root grants privileges by computing an hmac of the text of some
javascript with the key.

The example in my code is currently:  suppose I want to grant the
right to change the owner of /var/spool/databuilder/WHO to WHO:

go run tcb.go capngrant.go -v --keyfile=/tmp/key1 '(function(fs) {
return function (who) { var d = fs.admin("/var/spool/databuilder");
d.chown(d.subAdmin(who), who) }})'

where fs is in the style of the E file API, but with admin as well as
read and write.

The output is an hmac, e.g. tyyQUnUBoexIIcZitCRpTgLoNJGoAOViA8FVIykN7X0=

2. We put that hmac in Jenkins's password store. It does a reasonable
job of keeping passwords out of logs and it passes them around via
environment variables, which, as far as I can tell, has reasonable
security properties.

Then, with the js above is in priv1.js, and the environment variable
priv1 is bound to the hmac above, jenkins runs:

capnadmin dostuff.js --with priv1 priv1.js

and dostuff.js is expected to evaluate to a function, say, dostuff,
which gets invoked as: dostuff({priv1: ...}) where priv1 is the
capability from the grant step (1). So dostuff.js can set ownership in
just certain ways.


That's the idea anyway.

It seems a little silly to wave my hands like this without pointing
you at the code, but I'm fumbling with things like bitbucket vs.
github, not to mention whether I put anything sensitive in there while
coding in "I want to scream!" mode.

but for reference: 9aa7cf7256d9

(internally: AttenuatedRootAccess in our wiki)


-- 
Dan Connolly
http://www.madmode.com/