@"rvp"#p9453 Just in case you'd like to know there's a wrapper around `su` available in _wip_, [runas](https://github.com/outpaddling/runas)

@"rvp"#p9453 It will, but that is not the point. There is a good reason why people use `sudo` or `doas` instead of `su`, both security- and usability-wise.

@"vazub"#p9456 I know you didn't ask and I know is GPL licensed but, I use [please](https://www.usenix.org.uk/content/please.html). It allows granular control over which users are allowed to do what.

> @"vazub"#p9456 There is a good reason why people use `sudo` or `doas` instead of `su` Sure, if you're an ISP, or run a university network, then `su` is not fine-grained enough; but, for most home-user/enthusiast/hacker use-cases, it's all that's needed. > @"pin"#p9454 Just in case you'd like to know there's a wrapper around `su` available in wip, [runas](https://github.com/outpaddling/runas) Heh. I didn't know this. And, just how I run `su` too: always with `-l` 😄

> @"pin"#p9458 I know you didn't ask and I know is GPL licensed but, I use [please](https://www.usenix.org.uk/content/please.html). GPL discussion aside, what would be the technical/security/UX benefits of using `please` over `doas` or `priv`? > @"rvp"#p9459 Sure, if you're an ISP, or run a university network, then su is not fine-grained enough; but, for most home-user/enthusiast/hacker use-cases, it's all that's needed. This case is a good example. However, the utility of other discussed tools is that they promote some universal workflow, not purely for limited cases like the one you mentioned.

> @"rvp"#p9459 Heh. I didn't know this. And, just how I run su too: always with -l do you have a function set up for this? ``` sudo () { su -l root -c "$@" ; } ```

> @"pfr"#p9503 do you have a function set up for this? Close :). I have a script which is almost the same: I have `"$*"` instead of `"$@"` (`"$@"` won't work here because `-c` takes a _single_ argument).

> @"rvp"#p9517 I have "$*" instead of "$@" ("$@" won't work here because -c takes a single argument). Ahh thank you. I was trying to figure that out! I probably wont use it becuase I use `please` and `pleaseedit` on NetBSD, althought I might use it on my Void machine. I did try this function on linux in `zsh` but I couldn't get it to take multiple arguments without _"putting them in quotes"_. On Void I currently use `doas` but I've kept `sudo` installed because I prefer to use of `sudoedit` to edit root files. Unfortunately `doas` does not have a similar function. (I should just install `please`/`pleaseedit`) I'm curious if you could implement a `sudoedit` type function using `su`.

> @"pfr"#p9518 I'm curious if you could implement a `sudoedit` type function using `su` `sued`?[1] ```sh #!/bin/sh # # set -eu # umask 077 # rm -f /tmp/sued-helper.sh # prevent any symlink shenanigans # echo 'exec /usr/bin/vi -S "$@"' > /tmp/sued-helper.sh # exec su -m root /tmp/sued-helper.sh "$@" set -eu . ~/bin/q.sh umask 077 # XXX EDITOR='/usr/bin/vi -S' # $EDITOR *must* disallow shell-escapes. exec su -m root -c "$EDITOR $(q "$@")" ``` Run as: ```sh $ sued /etc/passwd /netbsd ``` Function `q()` is [here](https://www.unitedbsd.com/d/308-moritz-systems-bsd-tips-and-tricks/20). [1] Ie: If you use this script wrongly and somehow lose your `/etc/passwd`, don't `su(1)` me!

> @"rvp"#p9525 sued?[1] Funny, I have `alias sued="sudoedit"` in my `.zshrc` (although I don't use `ed`) I also renamed the above shell function to `suas` so to not replace `sudo` 😆 > @"rvp"#p9525 Run as: > ``` > $ env EDITOR=/bin/ed sued /etc/passwd /netbsd Why are you calling `EDITOR=/bin/ed` when the editor is set in the script? Also, why is `/etc/passwd` and `/netbsd` included in the command?

Random thought: The roles/profiles/tasks system of Solaris RBAC allows for a more fine-grained control over user priviliges and would represent a good starting point to take inspiration from for a future *BSD project.

doas, su discussion

pfr

rvp Is this the version of suec you have?

no, I've been using this:

#!/bin/sh
#
# ec < edit command

file_path=$(command -v "$1" 2>/dev/null)

if [ -z "$file_path" ]; then
    printf "%s\n" "Error: $1 not found"
    exit 1
fi

sued "$file_path"

rvp Don't recall what suas is...

I just renamed runas to suas

#!/bin/sh
set -e
su -l root -c "$*"

Didn't catch the q.sh edit before..

EDITOR='/usr/bin/vi -S' # $EDITOR *must* disallow shell-escapes.
vim?

rvp

#!/bin/sh 
. ~/bin/q.sh
exec su root -c "$(q "$@")"

I get:

~ λ suec sued
Password:
Error:  not found

rvp

pfr no, I've been using this:

Dunno what that script is for...

pfr I just renamed runas to suas

So, your suas is my suec (or is it, "Mi casa es su casa?"--so hard to keep track...)

pfr Didn't catch the q.sh edit before..

You need it in case the commands you run have whitespace or other funny chars. embedded in it.

pfr vim?

Man-page, mate (takes 10 secs): vim -Z

pfr ~ λ suec sued

With my suec, that's a wrong usage. You don't need to use suec to run sued.
Usage is:

suec ls -l /
suec ls -l 'file with spaces.txt'
suec sh -c 'ls -l "file with spaces.txt"; pwd'

sued file1 file2 ...

With the old suec (suas, runas, ...?!), 2. & 3. need to be quoted differently:

suas ls -l '"file with spaces.txt"'
suas 'ls -l "file with spaces.txt"; pwd'

Pick the one you find simplest.

pfr

rvp With my suec, that's a wrong usage

Yeah, there is just confusion as I'm using a different suec command which translates to super user edit command to edit all of my scripts in /usr/local/bin or anywhere in $PATH. I suppose I could simply add my scripts to ~/.local/bin instead and avoid the need to use su but oh well..

So hence the usage: $ suec sued is simply going to edit the sued command.. althought obviously I got mixed up with the names and tried using your version with the intended purpose of my old version.

Jay

Also worth checking priv : https://cdn.netbsd.org/pub/pkgsrc/current/pkgsrc/security/priv/index.html

pfr

So i decided to move all of my scripts from /usr/local/bin/ into ~/.local/bin

And I now have the following in there..

suas -- replacement for doas:

#!/bin/sh
. ~/.local/bin/q.sh
exec su root -c "$(q "$@")"

sued -- replacement for sudoedit:

#!/bin/sh
set -eu

. ~/.local/bin/q.sh
umask 077           # XXX
EDITOR='/usr/pkg/bin/vim -Z'        # $EDITOR *must* disallow shell-escapes.

exec su -m root -c "$EDITOR $(q "$@")"

ec:

#!/bin/sh
#
# ec < edit command within users $PATH

set -eu
. ~/.local/bin/q.sh
umask 077
EDITOR='/usr/pkg/bin/vim -Z'

file_path=$(command -v "$1" 2>/dev/null)

if [ -z "$file_path" ]; then
    printf "%s\n" "Error: $1 not found"
    exit 1
fi

$EDITOR "$(q "$file_path")"

And just in case, suec:

#!/bin/sh
#
# ec < edit command within users $PATH
# suec < ec < as root

set -eu
. ~/.local/bin/q.sh
umask 077
EDITOR='/usr/pkg/bin/vim -Z'

file_path=$(command -v "$1" 2>/dev/null)

if [ -z "$file_path" ]; then
    printf "%s\n" "Error: $1 not found"
    exit 1
fi

exec su -m root -c "$EDITOR $(q "$file_path")"

Now that all my scripts are in ~/.local/bin I wont need to use suec as often, however it's there if I need it.

rvp

pfr ec:

You don't need q() here at all. Just do: $EDITOR "$file_path"

pfr And just in case, suec:

Same--no extra quoting with q() needed. You can just call sued "$file_path" instead of re-doing what sued already does. (It worked for me.)

« Previous Page