Re: (Hopefully) quick policy question

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--===============7759730355419084988==
Content-Language: en-US
Content-Type: multipart/signed; micalg=pgp-sha256;
 protocol="application/pgp-signature";
 boundary="------------cuJOKBlJ1VTm3r9GlEleXz60"

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--------------cuJOKBlJ1VTm3r9GlEleXz60
Content-Type: multipart/mixed; boundary="------------MM8KCmTFsaaU0wijnMHNcDEd";
 protected-headers="v1"
From: Mihai Moldovan <[email protected]>
To: [email protected]
Message-ID: <[email protected]>
Subject: Re: [sudo-users] (Hopefully) quick policy question
References: <[email protected]>
 <[email protected]>
 <[email protected]>
In-Reply-To: <[email protected]>

--------------MM8KCmTFsaaU0wijnMHNcDEd
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

* On 9/26/23 16:59, Jore wrote:
> Okay, to consider that approach, do you have any resources for what=20
> might be good start for that? As it stands, I don't really know how to =

> approach calling a bash script inside a bash script as root safely.

Nothing written down, but the concept is so easy that I hardly expect it =
to be
part of any resource.

If you want to call acme.sh and only allow specific parameters passed to =
it,
create a script such as acme-wrapper.sh (using any POSIX-compatible shell=
 should
do), which parses the arguments (either fully manually by iterating over =
"${@}"
or using helpers such as "getopts") and either errors out if it sees some=
thing
unexpected or eventually calls acme.sh (preferably with a hardcoded, read=
-only
location).

Within sudo, you'll only need to make acme-wrapper.sh executable as a dif=
ferent
user, since executing something else will retain privileges, unless they =
are
explicitly dropped.



The real magic happens in the wrapper, but what it does is completely you=
r
responsibility and must also be tailored to your needs, which, likewise m=
eans
that there's no "one size fits all" solution.



Mihai

--------------MM8KCmTFsaaU0wijnMHNcDEd--

--------------cuJOKBlJ1VTm3r9GlEleXz60
Content-Type: application/pgp-signature; name="OpenPGP_signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="OpenPGP_signature"

-----BEGIN PGP SIGNATURE-----

wsF5BAABCAAjFiEEbhHQj3UzgcdE8cg8H9Yu2W4lOocFAmUTDMEFAwAAAAAACgkQH9Yu2W4lOofJ
+hAA1LgUYG/I5Vid2O9H1WIUP4Rwx00BhC8d0aoBxh51ey0C+Wn/MHcK8+w3YqbBHFpRxjgWy7n4
mW1yfY+pEpYosrPMTkrBj0VP+ljvOp2t7Gr8eLhKU4Ns4RCiexMJINkLQ4PYOnaPkU1V4Euda9o2
LuKPJHXTYSSuX9NcRf8CyaVhay1horGtcxVre+hbtxsifzWfGjtgC44MY3O4OePwZBT1VkIEw5j1
dwrlyF8/uDCGzpaWTunCN4iwRIeOWLifboEXFxRISVoWpHaznBDmazeqNTDUZBcC095Gy+R05cvm
C1Nc7e1PmXRe/u0oqThuDbN+6hMdgF5PSrUThXibrdTbXvu+0Yv+8VrOFRPbkZKjIeeXjRf+acDE
ao9kqOhtftDtafRvdduKzzETOtIXBG3eifdla+EdgZsntUA4Lc2hurt3FYBSe3tFIg4oP/zYt/6e
OcTVptZpi4jJeFnfFumCA/BQQkpbSMdE2z5uVJ09nnv1MaxXbjvxyIeRkf7YUrkfOsqlJTjm8NoS
3B/KOvPzzA8WQ4YyUhW2+jaxDKW/QTeZ6HGvov+0YM+LPA82/P5HEF8IWPoLOYJfq2dQLdAHC9qE
htxd8Lru33eciuJtQUePE4QKREoYGfdNs82hTNBRUDlsx4sqBW98qxYAOeBR40k3HeDfjeEGrBrj
UAc=
=a6+S
-----END PGP SIGNATURE-----

--------------cuJOKBlJ1VTm3r9GlEleXz60--

--===============7759730355419084988==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

____________________________________________________________
sudo-users mailing list <[email protected]>
For list information, options, or to unsubscribe, visit:
https://www.sudo.ws/mailman/listinfo/sudo-users

--===============7759730355419084988==--