What is the most secure way to use sudo permissions in a script?

Question

I have a bash script which needs to perform some actions while using sudo, both with root user permissions and permissions for other users, such as main user on a postgres database. These actions need to be performed without using a password, the main actions are to copy some files, specified by a list file, which are only accessible by root, to query whether a postgres database exists with a certain name and to take a dump from the database.

The user running the scripts is responsible for running quite a few different scripts. I understand that I can edit the /etc/sudoers file with visudo with a line like:

user ALL=(pg_dump_user) NOPASSWD:/usr/bin/pg_dump

or

user ALL=(pg_dump_user) NOPASSWD:/usr/bin/psql -lqt

I know that I can make the commands in the sudoers file a bit more specific, adding command options etc.

Would it be safer to call a script, which is only editable by root and using that script in the sudoers entries. Obviously with this approach I need to ensure that the directory permissions for the script location are correct, or it can just be replaced with something malicious. Are there any other actions I can take to make this more secure?

Answer 1

The easiest solution is merely to enable your script in sudoers. This should not introduce problems like having the script replaced ... so long as none of the parent directories are writable to non-root users. However, any security bugs in your script would be run as the target user, which might introduce something unsavory.

The safest solution is to either escalate only when necessary using sudo within your script or else to write your script very carefully and get its code audited by somebody familiar with your security concerns.

In @muru's second comment to the question, it was supposed that the simpler the scripting language (and the code), the less prone it is to having a security flaw. I agree with that. Limiting it to dash (assuming you've got dash as /bin/sh) will indeed help on that. Using a more comprehensive language like python increases the possibilities for both what you want and what might go wrong, so I'd only suggest it if you're more comfortable with it than a simple POSIX shell script.

Ultimately, this depends on what your code does. Figure out your risks and how much effort it would take to control them, then weigh each against the other. Who could abuse this? Sudo leaves an audit trail, so is the threat of being fired or expelled enough to keep would-be abusers in line?