1 |
On Wed, Sep 24, 2014 at 09:51:31PM -0700, Zac Medico wrote: |
2 |
> On 07/09/2014 07:17 AM, Michał Górny wrote: |
3 |
> >>> c) 'esudo' helper [3]. This is a more generic form of (2), with |
4 |
> >>> support for other potential privilege changes. |
5 |
> >> |
6 |
.. |
7 |
> > I don't think we'd use the reference 'sudo' impl. Rather some |
8 |
> > in-portage helper, possibly setuid. Or portage's IPC but that would |
9 |
> > imply running the command in an isolated environment (possibly |
10 |
> > beneficial). |
11 |
> |
12 |
> The environment doesn't necessarily have to be isolated, since we could |
13 |
> extend the existing environment saving/loading support to be used for by |
14 |
> esudo. The steps to implement the shared environment could be as follows: |
15 |
> |
16 |
> 1) When esudo is called, it saves the current (unprivileged) bash |
17 |
> environment to a file. |
18 |
> |
19 |
> 2) esudo uses IPC to request that a process with elevated privileges be |
20 |
> launched to run a specific command using the saved environment, and that |
21 |
> the environment of the elevated process be saved to a file after the |
22 |
> command completes. |
23 |
|
24 |
I don't think it's going to be quite that easy to get the output env, |
25 |
certainly not from some random command; tbh I don't even see the need |
26 |
for it, unless I'm missing something. From the "elevated process" after |
27 |
it waits on the child, but not from the child unless you control the |
28 |
code. |
29 |
|
30 |
> 3) Before esudo returns, it loads the environment that was saved by the |
31 |
> elevated process before it exited. |
32 |
|
33 |
What's the use-case for this part? I could see it with a function, but |
34 |
then you just run that as part of the ebuild. For running a specific |
35 |
command to access a device with privilege, or to add a user etc, I |
36 |
don't really see the point. (so why bother with the implementation |
37 |
complexity.) |
38 |
|
39 |
Other than that, I agree esudo is the best approach, and gives us |
40 |
much better granularity over privilege escalation, as discussed in |
41 |
the bug. |
42 |
|
43 |
Part of me thinks though, that it'd be much cleaner to give the |
44 |
portage user access to sudo. Isn't that effectively the purpose |
45 |
of the "suid helper"? In which case we get all the options for |
46 |
env etc, of sudo, and the admin gets to configure it along with |
47 |
the normal wheel setup. |
48 |
|
49 |
Just a thought. |
50 |
Regards, |
51 |
igli |
52 |
-- |
53 |
#friendly-coders -- We're friendly, but we're not /that/ friendly ;-) |