@"rvp"#p9453 Just in case you'd like to know there's a wrapper around `su` available in _wip_, [runas](https://github.com/outpaddling/runas)

@"rvp"#p9453 It will, but that is not the point. There is a good reason why people use `sudo` or `doas` instead of `su`, both security- and usability-wise.

@"vazub"#p9456 I know you didn't ask and I know is GPL licensed but, I use [please](https://www.usenix.org.uk/content/please.html). It allows granular control over which users are allowed to do what.

> @"vazub"#p9456 There is a good reason why people use `sudo` or `doas` instead of `su` Sure, if you're an ISP, or run a university network, then `su` is not fine-grained enough; but, for most home-user/enthusiast/hacker use-cases, it's all that's needed. > @"pin"#p9454 Just in case you'd like to know there's a wrapper around `su` available in wip, [runas](https://github.com/outpaddling/runas) Heh. I didn't know this. And, just how I run `su` too: always with `-l` 😄

> @"pin"#p9458 I know you didn't ask and I know is GPL licensed but, I use [please](https://www.usenix.org.uk/content/please.html). GPL discussion aside, what would be the technical/security/UX benefits of using `please` over `doas` or `priv`? > @"rvp"#p9459 Sure, if you're an ISP, or run a university network, then su is not fine-grained enough; but, for most home-user/enthusiast/hacker use-cases, it's all that's needed. This case is a good example. However, the utility of other discussed tools is that they promote some universal workflow, not purely for limited cases like the one you mentioned.

> @"rvp"#p9459 Heh. I didn't know this. And, just how I run su too: always with -l do you have a function set up for this? ``` sudo () { su -l root -c "$@" ; } ```

> @"pfr"#p9503 do you have a function set up for this? Close :). I have a script which is almost the same: I have `"$*"` instead of `"$@"` (`"$@"` won't work here because `-c` takes a _single_ argument).

> @"rvp"#p9517 I have "$*" instead of "$@" ("$@" won't work here because -c takes a single argument). Ahh thank you. I was trying to figure that out! I probably wont use it becuase I use `please` and `pleaseedit` on NetBSD, althought I might use it on my Void machine. I did try this function on linux in `zsh` but I couldn't get it to take multiple arguments without _"putting them in quotes"_. On Void I currently use `doas` but I've kept `sudo` installed because I prefer to use of `sudoedit` to edit root files. Unfortunately `doas` does not have a similar function. (I should just install `please`/`pleaseedit`) I'm curious if you could implement a `sudoedit` type function using `su`.

> @"pfr"#p9518 I'm curious if you could implement a `sudoedit` type function using `su` `sued`?[1] ```sh #!/bin/sh # # set -eu # umask 077 # rm -f /tmp/sued-helper.sh # prevent any symlink shenanigans # echo 'exec /usr/bin/vi -S "$@"' > /tmp/sued-helper.sh # exec su -m root /tmp/sued-helper.sh "$@" set -eu . ~/bin/q.sh umask 077 # XXX EDITOR='/usr/bin/vi -S' # $EDITOR *must* disallow shell-escapes. exec su -m root -c "$EDITOR $(q "$@")" ``` Run as: ```sh $ sued /etc/passwd /netbsd ``` Function `q()` is [here](https://www.unitedbsd.com/d/308-moritz-systems-bsd-tips-and-tricks/20). [1] Ie: If you use this script wrongly and somehow lose your `/etc/passwd`, don't `su(1)` me!

> @"rvp"#p9525 sued?[1] Funny, I have `alias sued="sudoedit"` in my `.zshrc` (although I don't use `ed`) I also renamed the above shell function to `suas` so to not replace `sudo` 😆 > @"rvp"#p9525 Run as: > ``` > $ env EDITOR=/bin/ed sued /etc/passwd /netbsd Why are you calling `EDITOR=/bin/ed` when the editor is set in the script? Also, why is `/etc/passwd` and `/netbsd` included in the command?

Random thought: The roles/profiles/tasks system of Solaris RBAC allows for a more fine-grained control over user priviliges and would represent a good starting point to take inspiration from for a future *BSD project.

doas, su discussion

rvp

pfr zsh .... (returning to bash soon)

No, mate, not your interactive one. I meant the shell executed by the shebang. It can't be zsh 'cuz a shell which has the kitchen-sink, the baby and its bath-water is sure to have -o pipefail as well.

I would guess dash. Everything other modern shell (except in strict-POSIX mode) supports that option.

rvp Sorry for jumping in again where I was not requested.
Yes, Void uses dash as the root shell.

pfr

rvp ahhh yes, I did not use my brain here.

pin Sorry for jumping in again where I was not requested.

You are always welcome to jump in, because you usually know whats going on in my system more than I do 😅

rvp

pin Jump in any time you like, mate! Yeah, I'll try to remember that dash doesn't know pipefail

@pin you have a working wireless in NetBSD, right? Does sysinst detect and configure it?

rvp

pin Can you please move this little discussion to this thread where it belongs?

rvp ~~Apparently I can't do that. I can select the messages to move but, I have no option to actually move them.~~

Sorry, done 🙂

pfr

rvp Minimal sued.sh

I've been using the earlier version you posted above
for a while anyway but will use this more minimal version for now.

rvp

pfr I've been using the earlier version you posted above

Ah, hell! I forgot to fix that version. Updated now.

pfr

rvp
So, out of the 3 possible impementations you've now shared, which one would be the most practical and/or sensible to use? The answer is not sudoedit 😆

rvp

pfr Hmm...no preference, actually. What does Goldilocks think?

pfr

rvp Goldilocks seems to prefer the version with the least amount of code.

pfr

Just ran into a situation where I wanted to use su root -c "$*" in a script, but only for certain commands within the script not all. So I wonder, when needing to use root privileges for several commands within a script, that are also in and amongst other commands that you normally wouldn't run as root, is it possible to call a command as a normal user within in the quoted string??

eg:

#!/bin/sh

set -eu

DIR1=/home/dave/.pkgsrc/
DIR2=/home/dave/.pkgsrc/pkgtools/osabi
DIR3=/home/dave/.pkgsrc/pkgtools/x11-links

su root -c " \

    # remove osabi and x11-links before upgrade
    pkg_delete osabi-NetBSD-9.2_STABLE x11-links-1.34 ; \

    # update pkgsrc
    cd $DIR1 && cvs update -dP ; \

    # update repositories
    pkgin update ; \

    # upgrade packages
    pkgin -y full-upgrade ; \

    # build and install osabi
    cd $DIR2 && su dave -c 'make -s' ; \
        make install clean distclean clean-depends ; \

    # build and install x11-links
    cd $DIR3 && su dave -c 'make -s' ; \
        make install clean distclean clean-depends ; \

    # remove orphan packages and clean pkgin
    pkgin -y autoremove && pkgin clean ; \

    "
# optionally also update pkgsrc/wip repo as normal user here
cd ~/.pkgsrc/wip && git pull -r

exit

Don't focus on what is actually going on in this script or ask why I'm removing and re-installing osabi and x11-links. What I'd like to know is, how can I run the make -s commands as a normal user within this list of commands being run as root? (I've been told by smarter people that you shouldn't run make as root)

My goal here is to use su root -c "$*" in place of something like sudo or doas and only enter my password once.

Where you could call sudo/doas for each command required to be run as root and still only enter your password once due to their "persistance" setting, with the su method I'd be asked for my password each time.

Eg. is it possible to do something like this...

su root -c " \ 
    run this root command ; \
    $(su user -c 'run this command as a user') ; \
    run another command as root
    "

The alternative is to build persistance into the suas script which I kinda guess would be more effort than it's worth?

rvp

pfr is it possible to call a command as a normal user within in the quoted string?

Yes. I'm doing that in one of the su?? scripts (I forget which 😛)

su root -c "
    [...]
    su user -c '...'
    [...]
"

But, that quickly ends up in Bourne-shell quoting-hell. Get around it by creating a temp. shell script and executing that.

pfr The alternative is to build persistance into the suas script

Persistence has to be built into the command itself (su), not the wrapper script.

pfr

rvp

Ok cool.

So what would you suggest is the cleaner option... I have two packages to build inside this script so I could do either of the following:

Option 1:

su root -c "
    [...]
    su dave -c 'cd $DIR3 && make -s ; cd $DIR4 && make -s' ; \
    cd $DIR3 && make install clean distclean clean-depends ; \
    cd $DIR4 && make install clean distclean clean-depends ; \
    [...]
"

Option 2:

su root -c "
    [...]
    su dave -c 'cd $DIR3 && make -s' ; \
    cd $DIR3 && make install clean distclean clean-depends ; \
    su dave -c 'cd $DIR4 && make -s' ; \
    cd $DIR4 && make install clean distclean clean-depends ; \
    [...]
"

I figure option 1 would be preferable as it's only switching user once but I don't know if you should really build two packages consecutively before installing them?

pfr

rvp Yes. I'm doing that in one of the su?? scripts (I forget which 😛)

@rvp Is this what you were talking about? (sued.sh)

rvp

# Invoke editor as (orig. user) on temp. files
#
 	if [ $N -gt 0 ]
 	then	su -l "$(id -nu $U)" -c "$E $TFF"
 	else	exit 1
 	fi

Shou'd I define U=$(/usr/bin/id -u) like you have in the sued script and use a command similar to the one above in my script?
~~I guess just adding my user name will work, but~~ I'd like scripts to be as universal as possible in case I change my user name in the future.

Edit:

I've realised that using su $USER -c "command" inside of a root command will just run the command as the root user.

I've also discovered that the two options above are not going to solve my problem because after the su dave -c "..." is executed, the following commands to be run as root will ask for my password again. Option 2 in my post above will ask for my password twice more.

I wonder, is there any way to use su inside of a single script, executing commands back and forth from root and user, and only enter my password at the beginnning of the script? I'm beginning to think not and have (for now) reverted to just using root for the entire script. I have however removed the last command from the script (Updated) to update the pkgsrc/wip repo as this would also get run as root (even if it was not inside the quoted string being run as root) 🤔 I was ending up with some packaged directories inside wip that were owend by root. I've just created an alias to pull down from pkgsrc/wip seperately.

pfr

rvp
Yeah, I'll admit it's a bit of a quirky scenario. The script is here.

Simply speaking though, I need my script to:

Only ask for my root password once, upon execution
Run multiple commands as root
Run one or more commands as a normal user (in and amongst the commands runing as root).

I understand how to run commands seperately for root and user, but my issue is that I cannot seperate these commands into a before and after scenario where I run the root commands before or after the regular user commands.

I'm beginning to think that this is not possible using the su only method and the only way out it to use sudo or doas witch can persist with a one time password.

It's not the end of the world if I can't make this work, I'm only curious.

rvp ends up in Bourne-shell quoting-hell. Get around it by creating a temp. shell script and executing that

What does this mean exactly, and would this be the solution here?

rvp

pfr Not entirely sure what's going on here without seeing the script you're trying to run, but, I think you can compile from all your packages from pkgsrc first as a regular user, then become root for all the make install steps.

rvp

pfr Simply speaking though, I need my script to:

Only ask for my root password once, upon execution

Run multiple commands as root

Run one or more commands as a normal user (in and amongst the commands runing as root).

Your Option 1 above should be able to do all that.

pfr

rvp
script no longer workie... gonna start a new thread.

pfr

I just read this article which was shared on lobste.rs

Had never heard of really(8) or userv before now, but as I seem to be interest in more simplified ways to elevate privileges it caught my eye.

Anyone ever used these tools or still do?

An interesting comment found on the lobste.rs thread shared this:

orly

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

int main(int argc, char** argv) {
    if (setuid(0)) {
        fprintf(stderr, "Couldn't set UID\n");
        exit(1);
    };

    if (setgid(0)) {
        fprintf(stderr, "Couldn't set GID\n");
        exit(1);
    }

    argv++;
    execvp(argv[0], argv);
}

$ $(CC) --std=c11 -Werror -Wall -o orly main.c
$ sudo setcap cap_setuid,cap_setgid=ep orly

@rvp I'm hoping you can translate this into english for me and give me your thoughts? (I've also replied to the author of this comment on lobste.rs asking for some explaination).

I still to this day use the suas sued suec scripts from this thread. I've still got opendoas installed for times when I don't want to be prompted for my password, but interested still in these other methods.

rvp

pfr give me your thoughts?

This works only on Linux.
Setting cap_set{u,g}id on a program is good, but then, you immediately do set{u,g}id(0); exec(). This defeats the whole purpose of having capabilities. You might just as well have installed this program setuid instead.
Doesn't even ask for a password, or make any auth checks. Anybody can become root using this.

pfr I still to this day use the suas sued suec scripts from this thread.

Ah, there's a terrible security bug in the simple version of sued which I completely forgot about. Fixed.

Is this the version of suec you have?

#!/bin/sh

. ~/bin/q.sh
exec su root -c "$(q "$@")"

Don't recall what suas is...

pfr The only downside I've found using onlu su so far is that there is no persist option and I am required to type my password every single time.

Sometime after you asked this, I thought up a quirky technique to do just this using standard su -- and then promptly forgot until you bumped this thread up. Thought it up again. Here it is:

Assumptions:

User running su is in group wheel.
The only way to login into the system is via SSH or in a terminal using login. (Ie. other services like telnet, ftp, ... are off.)

Steps:

Remove root's password. (ie. the password is empty.)

Make sure root can't login via SSH.
The PermitRootLogin setting should be turned off, or commented out (the latter is the default these days).

$ fgrep PermitRootLogin /etc/ssh/sshd_config
#PermitRootLogin prohibit-password
$

Ensure root can't login on a terminal either.
Remove the secure word from the on entries in /etc/ttys.

The end result should be that any user belonging to wheel should be able to su root w/o a password. And, you also can't login as root in any other way.

pfr

rvp Is this the version of suec you have?

no, I've been using this:

#!/bin/sh
#
# ec < edit command

file_path=$(command -v "$1" 2>/dev/null)

if [ -z "$file_path" ]; then
    printf "%s\n" "Error: $1 not found"
    exit 1
fi

sued "$file_path"

rvp Don't recall what suas is...

I just renamed runas to suas

#!/bin/sh
set -e
su -l root -c "$*"

Didn't catch the q.sh edit before..

EDITOR='/usr/bin/vi -S' # $EDITOR *must* disallow shell-escapes.
vim?

rvp

#!/bin/sh 
. ~/bin/q.sh
exec su root -c "$(q "$@")"

I get:

~ λ suec sued
Password:
Error:  not found

« Previous Page Next Page »