doas, su discussion

rvp Just in case you'd like to know there's a wrapper around su available in wip, runas

rvp

vazub There is a good reason why people use sudo or doas instead of su

Sure, if you're an ISP, or run a university network, then su is not fine-grained enough; but, for most home-user/enthusiast/hacker use-cases, it's all that's needed.

pin Just in case you'd like to know there's a wrapper around su available in wip, runas

Heh. I didn't know this. And, just how I run su too: always with -l 😄

pfr

rvp sued?[1]

So, just going back to this. It works, however it requires the full path as it obviously begins from the root directory. So I have to run sued /home/dave/myfile.sh. Is there anyway for it to recognise the current working dir with pwd or somesuch so I can just type sued myfile.sh form my $HOME ?

pin there's a wrapper around su available in wip, runas

I've looked at this. It seemes to do the exact same thing as this function runas () { su -l root -c "$*" ; }. Besides being able to run commands as users other than root what is the benefit of installing runas over just using this function?

Continuing on...

On a related note (perhaps we should move this discussion to another thread?) I'd like to replicate the !! function in bash & zsh where if you forget sudo/doas/runas and you get "permission denied" you can just type sudo !! and it'll run the previous command prepended with sudo (or whatever you put before !! ).

I've tried alias please="runas $(fc -ln -1)" however upon opening a new terminal I immediately get:

/bin/ksh: /home/dave/.shrc[274]: fc: not interactive

However, If I simply run the command runas $(fc -ln -1) in the terminal it works just fine. But why?

vazub

rvp
It will, but that is not the point. There is a good reason why people use sudo or doas instead of su, both security- and usability-wise.

vazub I know you didn't ask and I know is GPL licensed but, I use please.
It allows granular control over which users are allowed to do what.

vazub

pin I know you didn't ask and I know is GPL licensed but, I use please.

GPL discussion aside, what would be the technical/security/UX benefits of using please over doas or priv?

rvp Sure, if you're an ISP, or run a university network, then su is not fine-grained enough; but, for most home-user/enthusiast/hacker use-cases, it's all that's needed.

This case is a good example. However, the utility of other discussed tools is that they promote some universal workflow, not purely for limited cases like the one you mentioned.

pfr

rvp Heh. I didn't know this. And, just how I run su too: always with -l

do you have a function set up for this?

sudo () { su -l root -c "$@" ; }

rvp

pfr do you have a function set up for this?

Close 🙂. I have a script which is almost the same: I have "$*" instead of "$@" ("$@" won't work here because -c takes a single argument).

pfr

rvp I have "$*" instead of "$@" ("$@" won't work here because -c takes a single argument).

Ahh thank you. I was trying to figure that out!

I probably wont use it becuase I use please and pleaseedit on NetBSD, althought I might use it on my Void machine. I did try this function on linux in zsh but I couldn't get it to take multiple arguments without "putting them in quotes".

On Void I currently use doas but I've kept sudo installed because I prefer to use of sudoedit to edit root files. Unfortunately doas does not have a similar function. (I should just install please/pleaseedit)

I'm curious if you could implement a sudoedit type function using su.

rvp

pfr I'm curious if you could implement a sudoedit type function using su

sued?[1]

#!/bin/sh
#
# set -eu
# umask 077
# rm -f /tmp/sued-helper.sh	# prevent any symlink shenanigans
# echo 'exec /usr/bin/vi -S "$@"' > /tmp/sued-helper.sh
# exec su -m root /tmp/sued-helper.sh "$@"

set -eu
. ~/bin/q.sh
umask 077			# XXX
EDITOR='/usr/bin/vi -S'		# $EDITOR *must* disallow shell-escapes.
exec su -m root -c "$EDITOR $(q "$@")"

Run as:

$ sued /etc/passwd /netbsd

Function q() is here.

[1] Ie: If you use this script wrongly and somehow lose your /etc/passwd, don't su(1) me!

pfr

rvp sued?[1]

Funny, I have alias sued="sudoedit" in my .zshrc (although I don't use ed)

I also renamed the above shell function to suas so to not replace sudo 😆

rvp Run as:

$ env EDITOR=/bin/ed sued /etc/passwd /netbsd

Why are you calling EDITOR=/bin/ed when the editor is set in the script?
Also, why is /etc/passwd and /netbsd included in the command?

pfr

rvp

So I've been using this sued script in combination with the the following function for a while and 've completely removed all other authentication tools (sudo/doas/please)

suas () { su root -c "$*" ; }

rvp Remove the -l flag.

This was also very helpful. Thanks!

What I am interested in however is whether there is a way to repliate the traditional sudoedit function of copying a file to /tmp for editing then replacing the original upon saving, rather than just running vim as root in the files location.

rvp

pfr Why are you calling EDITOR=/bin/ed when the editor is set in the script?

That's the anti-example. (Actually, I just thought the proper example was too boring.)

pfr Also, why is /etc/passwd and /netbsd included in the command?

Ditto. (I believe that's how Ken Thompson writes gigabit ethernet drivers...)

JuvenalUrbino

Random thought:
The roles/profiles/tasks system of Solaris RBAC allows for a more fine-grained control over user priviliges and would represent a good starting point to take inspiration from for a future *BSD project.

rvp

pfr Is there anyway for it to recognise the current working dir

Remove the -l flag.

pfr what is the benefit of installing runas over just using this function?

In a word: quoting. Create a file with spaces in its name, then try to remove it using your runas function.

pfr However, If I simply run the command runas $(fc -ln -1) in the terminal it works just fine. But why?

Quoting again. Things inside double-quotes are expanded at the time of assignment, which is not what you want for aliases. Use single-quotes here.

pfr

rvp Create a file with spaces in its name

I dont think I'd ever do anything so heinous! 😱

rvp Quoting again. Things inside double-quotes are expanded at the time of assignment, which is not what you want for aliases. Use single-quotes here.

so alias please='runas $(fc -ln -1)' ? Will have to try this out later.
EDIT: That worked, thanks 😀
But this begs the question, should I replace all of the double quotes in my alias list with single quotes for correctness?

EDIT: @Jay , Is it possible to merge all of the comments on authentication tools from this thread into a new thread? Id like to keep discussing it but I don't want to keep spamming this thread. I also don't want to start a new thread and lose all of the helpful comments in this thread thus far.

rvp

pfr should I replace all of the double quotes in my alias list with single quotes for correctness?

Don't bother: if it ain't broke, don't fix it.

pfr I dont think I'd ever do anything so heinous!

That's mostly harmless. This, is heinous:

Let's say Dashing Dave has a bunch of text files in some shared writable directory:

$ ls -l
total 8
-rw-r--r--  1 dave  wheel  2 27 Nov 21:59 foo1.txt
-rw-r--r--  1 dave  wheel  2 27 Nov 21:59 foo2.txt
$

Dave's mortal enemy Dastardly Dick just adds a cute little file:

$ >'foo3.txt;echo hacked>passwd;rm -f foo3*'
$

then...waits. One day, our hero Dave does this:

$ runas cat foo*                                        # ho hum, just 'nother day
Password:                                               # script working as per spec., I see...
1
2
cat: foo3.txt: No such file or directory                # pfft! NetBSD acting weird again!
$ ls -l                                                 # let's see...nope, nothing wrong here.
total 12
-rw-r--r--  1 dave   wheel  2 27 Nov 21:59 foo1.txt
-rw-r--r--  1 dave   wheel  2 27 Nov 21:59 foo2.txt
-rw-r--r--  1 dave   wheel  7 27 Nov 22:00 passwd
$ cat passwd                                            # Dastardly Dick strikes again!
hacked
$

Replace passwd with /etc/passwd and you'll see why Dave would be dashed. (This is why I've got that elaborate quoting machinery in my sued script.)

rvp

pfr What I am interested in however is whether there is a way to repliate [...]

Sure there is...but, who's gonna bell that 😼? sudoedit, according to the manpage, does more than just copy files. Making a faithful substitute in a shell script is sure to be hairy...

pfr

rvp Fair enough. It was just a curious thought, that's all.

rvp

pfr Since it's Christmas and all... Try:
~~(Bug fixes next year)~~

sued.sh

#!/bin/sh
#
# sued: sudoedit (most of) as a shell-script
#
# Test:
#
# As root:
# install -d -m 755 $'hello\n"world\n;>foo\t'\'$'$bar\n'
# cp /etc/passwd $'hello\n"world\n;>foo\t'\'$'$bar\n'/.
# echo x > $'hello\n"world\n;>foo\t'\'$'$bar\n'/$'xxx\n  yyy\t\n'
#
# Then, as a regular user:
# sued.sh hell*/xxx* hell*/passwd

umask 077				# be paranoid
ME=${0##*/}
MAGIC=SUED_FiFi_the_FLeA_CHILD

# Bourne-shell string quoting
# turns:
#	hello world   -> 'hello world'
#	hello 'world' -> 'hello '\''world'\''
#

# q()
# {
# 	printf "'"
# 	printf '%s' "$1" | sed -Ee "s/'/'\\\\''/g"
# 	printf "'"
# }

q()
{
	awk -f - "$1" <<\EoF
BEGIN {
        if (ARGC != 2)
                exit 1
        printf("'")
        for (i = 1; i <= length(ARGV[1]); i++) {
                c = substr(ARGV[1], i, 1)
                if (c == "'")
                        printf("'\\%c'", c)
                else
                        printf("%c", c)
        }
        printf("'")
}
EoF
}

# Check for invalid things:
#   empty ("") filenames
#   files in writable dirs.
#
isok()
{
	if [ -z "$1" ]
	then	echo "$ME: skipping empty filename" >&2
		return 1
	fi
	if [ -w "$(/usr/bin/dirname "$1")" ]
	then	echo "$ME: $1: editing files in a writable directory is not permitted" >&2
		return 1
	fi
	return 0
}

# Shell quoting is a pain in the southern-hemispheres and we don't
# want to use a helper script, so just re-exec ourself and do the
# real work in the re-exec'd (priviledged) instance.
#
if [ "$1" != $MAGIC ]			# Primary instance
then	set -eu
	E=$(q "${EDITOR:=vi}")
	U=$(/usr/bin/id -u)
	G=$(/usr/bin/id -g)
	F=""
	rc=0
	N=0
	for A
	do	if isok "$A"
		then	F="$F $(q "$A")"
			N=$((N + 1))
		else	rc=1
		fi
	done
	if [ $N -eq 0 ]
	then	if [ $rc -eq 1 ]	# error msg. already printed
		then	exit 1
		fi
		echo "Usage: $ME FILE..." >&2
	fi
	exec su root -c "$0 $MAGIC $E $U $G $F"
else	set -eu -o pipefail		# Re-exec'd instance
	E=$(q "$2")			# snag user's editor
	U=$3				#  " orig UID
	G=$4				#  " orig GID
	shift 4

	# Create temporary files
	#
	TFF=""
	N=0
	for f
	do	if [ \! -f "$f" ]
		then	echo "$ME: $f: non-existent or non-regular file" >&2
			continue
		fi
		FU=$(/usr/bin/stat -f %u "$f")
		FG=$(/usr/bin/stat -f %g "$f")
		FM=$(/usr/bin/stat -f %Mp%Lp "$f")
		T=$(/usr/bin/basename "$f")
		T=$(/usr/bin/mktemp "/var/tmp/$T.XXXXXX")
		/usr/sbin/chown $U:$G "$T"
		/bin/cat "$f" > "$T"	# copy contents into temp. file
		eval U$N=$FU		# an array! an array! my kingdom
		eval G$N=$FG		#   for an array!
		eval M$N=$FM
		f=$(q "$f")		# quote for eval
		eval FN$N="$f"		# stash orig. name
		T=$(q "$T")		# quote for eval
		eval TF$N="$T"		# stash temp. name
		TFF="$TFF $T"		# collect
		N=$((N + 1))
	done

	# Invoke editor as (orig. user) on temp. files
	#
	if [ $N -gt 0 ]
	then	su -l "$(id -nu $U)" -c "$E $TFF"
	else	exit 1
	fi
	
	# Copy temp. files back over originals
	#
	I=0
	while [ $I -lt $N ]
	do	eval T=\$TF$I				# extract temp. file name
		eval F=\$FN$I				#    "    orig.    "
		if /usr/bin/cmp -s "$T" "$F"
		then	echo "$ME: $F: unchanged"
			/bin/rm -f "$T"			# remove temp. file
		else	if [ $(/usr/bin/stat -f %z "$T") -eq 0 ]
			then	printf '%s: not replacing "%s" with 0-byte "%s"\n' \
					"$ME" "$F" "$T" >&2
				/bin/rm -f "$T"
			else	eval U=\$U$I		# set orig. file bits
				eval G=\$G$I
				eval M=\$M$I
				/usr/sbin/chown $U:$G "$T"
				/bin/chmod $M "$T"	# chmod _after_ chown
				/bin/mv "$T" "$F"
			fi
		fi
		I=$((I + 1))
	done
fi