Re: (Hopefully) quick policy question

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--===============5502062138916383965==
Content-Language: en-US
Content-Type: multipart/signed; micalg=pgp-sha256;
 protocol="application/pgp-signature";
 boundary="------------jQUm3MdNgbby0iixX3YxbOb5"

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--------------jQUm3MdNgbby0iixX3YxbOb5
Content-Type: multipart/mixed; boundary="------------zLhkTS0bRabr3W0RyhtUa46B";
 protected-headers="v1"
From: Mihai Moldovan <[email protected]>
To: [email protected]
Message-ID: <[email protected]>
Subject: Re: [sudo-users] (Hopefully) quick policy question
References: <[email protected]>
 <[email protected]>
 <[email protected]>
 <[email protected]>
 <[email protected]>
In-Reply-To: <[email protected]>

--------------zLhkTS0bRabr3W0RyhtUa46B
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

* On 9/26/23 20:18, Jore wrote:
> So I added this line to sudoers (and note the use of unwanted * glob=20
> again?? Is this still unsafe/can something better be here?):

The glob itself is not "unsafe". It just allows any and all user input. T=
here's
nothing particularly bad about it. You're sanitizing it later on anyway.


>     test ALL =3D NOPASSWD: /usr/bin/bash /home/test/acme-wrapper.sh *
>=20
>=20
> Regardless, when test user runs:
>=20
> $ bash /home/test/acme-wrapper.sh foobar123.example.com
> /usr/bin/bash: /root/.acme.sh/acme.sh: Permission denied
>=20

Because you probably meant to execute sudo bash /home/test/acme-wrapper.s=
h
foobar123.example.com? :)


> Also, this approach seems needlessly complicated?

It's more flexible and more complicated.

With sudo 1.9.10, support for regular expressions in sudoers rules has be=
en
added[0]. Previous versions do not support this. This feature is what you=
 would
like to have, but given that it's not supported in your version, you will=
 have
to do with something else.


> To my noob mind, it'd be much better to build some rule in to the=20
> sudoers file directly, no? If possible...

Again, it highly depends on what people want to achieve. If the only thin=
g
dynamic/user input is a domain name and you have a regular expression onl=
y
allowing the input you want to accept, that certainly is a convenient way=
 to go.
For more complicated cases, this quickly gets unwieldy (regular expressio=
ns are
pretty limited in what they can do too.)



Mihai


[0] https://www.sudo.ws/releases/stable/#1.9.10

--------------zLhkTS0bRabr3W0RyhtUa46B--

--------------jQUm3MdNgbby0iixX3YxbOb5
Content-Type: application/pgp-signature; name="OpenPGP_signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="OpenPGP_signature"

-----BEGIN PGP SIGNATURE-----

wsF5BAABCAAjFiEEbhHQj3UzgcdE8cg8H9Yu2W4lOocFAmUTW2UFAwAAAAAACgkQH9Yu2W4lOoeA
9w/9GquJ8BwPYrUoGvO3UEkJGb3r5CXOM8tZWkhis1qJKf3dxTVHYkwdb48aPbGBTcoH7QenitqN
QrZXzAWC3Lzwe3UFaXjQgjBycmBBsol2eq1/NRwP7nLqlsJmaQYwNWdzAuv+qzOuqBFg7hOls0eS
Lsllw07BTykxOxRa/Z4KjidKoVXaEGArtc3trOeQrvFDxWKjwPioT02VGstF5cCaturBcLCt7Gab
3BSLROJy2c6CPFAHTD4b55S/myf1vHBHnDafyGLonHzusD4BU4JWEF6yTuYzzX/LJ3IKiMaVkXtb
EIIowfw6ni8+yRR6o1P4eY8BT+V8dZ/qdLjbI9xWQeMYbuddzI+Ed+5er1S2Opd0mYKZh32bTetR
8S0uTUcQZ8O6zvLdYvCERkUWqPls/Z8E6ldslDdIfahFaZuHbeo0b9uKPu2tr58jHxa1XNERhRbw
rev/RJL46OWZXd9p29uxQMA1FiDiG7yxlkAB6VByy3KhvpFVhXMseFajmB+eLFkurGcKW1E9IdmU
tXQK/b/Tx8WltwtKHt/AbKJ9r4QgDL1K9gRKng6B0vN+k9jVGr+x2buJIZKbuDx1PY+bKbggIOWl
aSp+9xjSgMBUXX8S3/vCWyT3zKHylSYS8lseovXDFWDJ+ca5BDYsFt8lgO+TotcRpBMuBDXKt9Jm
JmQ=
=eCVy
-----END PGP SIGNATURE-----

--------------jQUm3MdNgbby0iixX3YxbOb5--

--===============5502062138916383965==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

____________________________________________________________
sudo-users mailing list <[email protected]>
For list information, options, or to unsubscribe, visit:
https://www.sudo.ws/mailman/listinfo/sudo-users

--===============5502062138916383965==--