1 |
On 09/28/2014 09:23 PM, Steven J. Long wrote: |
2 |
> On Wed, Sep 24, 2014 at 09:51:31PM -0700, Zac Medico wrote: |
3 |
>> On 07/09/2014 07:17 AM, Michał Górny wrote: |
4 |
>>>>> c) 'esudo' helper [3]. This is a more generic form of (2), with |
5 |
>>>>> support for other potential privilege changes. |
6 |
>>>> |
7 |
> .. |
8 |
>>> I don't think we'd use the reference 'sudo' impl. Rather some |
9 |
>>> in-portage helper, possibly setuid. Or portage's IPC but that would |
10 |
>>> imply running the command in an isolated environment (possibly |
11 |
>>> beneficial). |
12 |
>> |
13 |
>> The environment doesn't necessarily have to be isolated, since we could |
14 |
>> extend the existing environment saving/loading support to be used for by |
15 |
>> esudo. The steps to implement the shared environment could be as follows: |
16 |
>> |
17 |
>> 1) When esudo is called, it saves the current (unprivileged) bash |
18 |
>> environment to a file. |
19 |
>> |
20 |
>> 2) esudo uses IPC to request that a process with elevated privileges be |
21 |
>> launched to run a specific command using the saved environment, and that |
22 |
>> the environment of the elevated process be saved to a file after the |
23 |
>> command completes. |
24 |
> |
25 |
> I don't think it's going to be quite that easy to get the output env, |
26 |
> certainly not from some random command; tbh I don't even see the need |
27 |
> for it, unless I'm missing something. From the "elevated process" after |
28 |
> it waits on the child, but not from the child unless you control the |
29 |
> code. |
30 |
|
31 |
We control the shell code that launches the requested command, so we can |
32 |
save the environment after the requested command completes (using a |
33 |
modified version of our existing environment persistence code). |
34 |
|
35 |
>> 3) Before esudo returns, it loads the environment that was saved by the |
36 |
>> elevated process before it exited. |
37 |
> |
38 |
> What's the use-case for this part? I could see it with a function, but |
39 |
> then you just run that as part of the ebuild. For running a specific |
40 |
> command to access a device with privilege, or to add a user etc, I |
41 |
> don't really see the point. (so why bother with the implementation |
42 |
> complexity.) |
43 |
|
44 |
Well, maybe it's not very useful. I just thought I'd mention it in case |
45 |
anyone found it useful for some reason. |
46 |
|
47 |
> Other than that, I agree esudo is the best approach, and gives us |
48 |
> much better granularity over privilege escalation, as discussed in |
49 |
> the bug. |
50 |
|
51 |
Yeah, me too. |
52 |
|
53 |
> Part of me thinks though, that it'd be much cleaner to give the |
54 |
> portage user access to sudo. Isn't that effectively the purpose |
55 |
> of the "suid helper"? In which case we get all the options for |
56 |
> env etc, of sudo, and the admin gets to configure it along with |
57 |
> the normal wheel setup. |
58 |
|
59 |
Depending on our goals, using sudo may or may not have advantages. It. |
60 |
really depends on whether or not we want esudo to interact with the |
61 |
local sudo configuration. If we want it to be independent of the local |
62 |
sudo configuration, then it makes sense for the package manager to use |
63 |
it's own privilege escalation mechanism. |
64 |
-- |
65 |
Thanks, |
66 |
Zac |