Re:Heap-based buffer overflow in Sudo
by GoblinSlayer on Wednesday January 27, 2021 @01:57PM
(#25932270)
I want to start and stop a couple of systemd services remotely. Currently I expose the command with sudo and run it under a remotely connected user. What are other options?
You don't actually have to be root at all to manage systemd services. If you give the user `org.freedesktop.systemd1.manage-units` in Polkit then they can just run systemctl as their user and it will work.
If you only want to allow specific units the authorizer is passed the unit under `action.lookup("unit")`.
In your case either use plain /sbin/su: https://man7.org/linux/man-pages/man1/su.1.html or login via root. Your use case sounds very sudo-like, thought. Probably stick to sudo.
Re:Heap-based buffer overflow in Sudo
by GoblinSlayer on Wednesday January 27, 2021 @04:21PM
(#25934112)
It's a batch job. Ah, I see it mentions runuser, will check it.
Re:Heap-based buffer overflow in Sudo
by moistbar on Wednesday January 27, 2021 @02:45PM
(#25932954)
sudo doesn't have to grant full root access to everyone in the group. It can be set up such that certain users only have the ability to run specified commands as root, which is handy for orgs where you might have a group of tier 1 techs that you want to be able to run certain scripts (written by tier 2 or 3, of course) that require root, but you don't trust the engineers enough to have root access to everything.
It is almost always the case that a sufficiently malicious user can find a way to turn that into full blown root access.
So that means they should get full blown root from the beginning?
why do you need to have sudo? I'm perfectly fine without it. sudo is maybe useful in the case where others on the system don't need to know the a password to run as someone else (including root) but need to be able to do that anyway. sudo seems to have gotten a big installation bases through ubuntu and everybody thinks it's normal now, but really for me it's not.