Re: [gentoo-security] Prevent users to login directly

[Bart Alewijnse]

Errm. I was referring to the *user* 'emerge' - I wasn't aware you can
use su to execute binaries. sudo, yes, but su? 'sudo su emerge' would
cause sudo to run su with the command line parameter 'emerge' which
can only be a username - rather than hand sudo two executable names,
right?
But if you're paranoid, you could likely require the path to emerge in
sudoers, so that it'd have to be
'sudo su /usr/bin/emerge' - or possibly just that it'd only accept
running emerge if the actual emerge binary being suggested for running
is the one in /usr/bin. Since you don't have direct accidental access
to that as either considered user, it's not a risk.

Again with the calling me undercaffeinated if I'm missing something.

But as to the being bad, I don't see how it's not an entirely moot point. 

You give them root access one way or the other, be it directly, or
indirectly quite simply because you allow them full access to the
filesystem through emerge - you have to, or emerge wouldn't work. If
they wanted to be bad, they could do what they wanted anyhow - say,
make a portage package that'd have the added featuer of also mailing
them the password shadow file.

If this needs to work, and cleanly, it needs to be authentication
within emerge, as far as I can see.

--Bart Alewijnse

--
gentoo-security@g.o mailing list