3

I have a bash script which needs to perform some actions while using sudo, both with root user permissions and permissions for other users, such as main user on a postgres database. These actions need to be performed without using a password, the main actions are to copy some files, specified by a list file, which are only accessible by root, to query whether a postgres database exists with a certain name and to take a dump from the database.

The user running the scripts is responsible for running quite a few different scripts. I understand that I can edit the /etc/sudoers file with visudo with a line like:

user ALL=(pg_dump_user) NOPASSWD:/usr/bin/pg_dump

or

user ALL=(pg_dump_user) NOPASSWD:/usr/bin/psql -lqt

I know that I can make the commands in the sudoers file a bit more specific, adding command options etc.

Would it be safer to call a script, which is only editable by root and using that script in the sudoers entries. Obviously with this approach I need to ensure that the directory permissions for the script location are correct, or it can just be replaced with something malicious. Are there any other actions I can take to make this more secure?

  • Safer? Dunno. More convenient? Probably. If you specify arguments to a sudoer command without wildcards, sudo will expect that command to be provided exactly as is, so you might have to use wildcards, and * might open up a can of worms depending on the command. A script might make it easier for you to avoid using that wildcard, while still retaining some flexibility. But it all depends... – muru Oct 5 '16 at 12:16
  • I thought it might be quite dependent on what commands are actually being run. – Arronical Oct 5 '16 at 12:18
  • 4
    Aside from the permissions, depending on how paranoid you're about bugs like shellshock, use a simpler shell like dash for the script, or use a safer language like Python, where you have to call fewer external programs. – muru Oct 5 '16 at 12:18
0

The easiest solution is merely to enable your script in sudoers. This should not introduce problems like having the script replaced ... so long as none of the parent directories are writable to non-root users. However, any security bugs in your script would be run as the target user, which might introduce something unsavory.

The safest solution is to either escalate only when necessary using sudo within your script or else to write your script very carefully and get its code audited by somebody familiar with your security concerns.

In @muru's second comment to the question, it was supposed that the simpler the scripting language (and the code), the less prone it is to having a security flaw. I agree with that. Limiting it to dash (assuming you've got dash as /bin/sh) will indeed help on that. Using a more comprehensive language like python increases the possibilities for both what you want and what might go wrong, so I'd only suggest it if you're more comfortable with it than a simple POSIX shell script.

Ultimately, this depends on what your code does. Figure out your risks and how much effort it would take to control them, then weigh each against the other. Who could abuse this? Sudo leaves an audit trail, so is the threat of being fired or expelled enough to keep would-be abusers in line?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.