Of all tyrannies, a tyranny sincerely exercised for the good of its victims may be the most oppressive. It would be better to live under robber barons than under omnipotent moral busybodies. The robber baron’s cruelty may sometimes sleep, his cupidity may at some point be satiated; but those who torment us for our own good will torment us without end for they do so with the approval of their own conscience.
– C. S. Lewis
“Data is not information, information is not knowledge, knowledge is not understanding, and understanding is not wisdom.”
–Clifford Stroll
From http://www.washingtonpost.com/blogs/answer-sheet/wp/2013/12/31/i-would-love-to-teach-but/
I don’t think you should be using sudo and maybe you shouldn’t be using Linux at all.
The money quote. Love this. Article was well written with clear and helpful examples. Thanks, Tony.
via Understanding and using sudo in Unix or Linux (with examples).
Nobody has told me much about Linux, but I have learned vast amounts from the community. There is a downside to that, however. In an interactive conversation, certain things may come up that generate further discussion by their nature, whereas simple consumption from the web (or any other medium) may leave a vague hunch without actually provoking the “deeper dive”, if you will.
Such is the case, for me, with sudo and setuid. I’ve always had the impression that setuid was a “bad thing to do”™, because (in an overly broad and general sense) if your setuid application was compromised by a security flaw, your system was effectively compromised. sudo was “a good thing”™, because you could perform administrative functions easily without having to log out, log in as root, take care of the task at hand, and then return to your normal user shell.
Fast forward to today. I’ve been doing some testing with check_mk, and ran into an issue where the default host check utilizes the Nagios check_icmp plugin. When check_mk attempts to run same, it fails with an error indicating that the executable must be run as root or have setuid root set. I presume the reason Nagios (or “nagios”, if you want to call the process by its username) is able to perform the checks is because the process is initiated as root and drops privileges, but maintains the permissions required to interface with the network stack. In this case, (I think… haven’t proved it yet) it’s irrelevant. What I really want to know is – which is the better option to use, given that I can change the command used for the default check to use sudo if needed.
Jump... to conclusions!
After reading Tony’s article and taking into consideration that the sudo application itself is a setuid binary, I’m going to make a quick jump to conclusions that probably doesn’t much matter in any case, since the executable will be effectively running as root. I’m going to go with an edit to /etc/sudoers that will permit just the webserver account to run the plugin as root. I have two reasons for this approach, one or both of which may be wrong.
First, I suspect there have been a lot more eyes on the code for the sudo binary than on the Nagios plugin binary, and if there’s going to be a flaw in one, it’s probably the latter (n.b. – I would not expect to see a flaw in the Nagios code, either… monitoring systems are, by their very purpose, allowed to converse with very critical infrastructure and best practices in development and security should be priorities).
Second, using sudo I can allow limited access to run the plugin as root, restricting that ability to just the webserver user account. With setuid, any user who has the ability to execute the program (given a mask of 755, effectively everyone) can A.) run the program, and B.) do so as root.
In a perfect world – or maybe just a parallel dimension to this one – I could (and perhaps should) set the user and group ownership of the file more specifically, chmod o-x the plugins, and then chmod u+s the particular check_icmp plugin I needed. This would likely be a more achievable solution in cases where it is difficult or impossible to control how the binary is called.
EDIT: So, there’s an interesting new problem with this approach. While the return code from the executed plugin is provided as the return code from sudo, the data returned by the plugin is sadly missing. This makes sense, and it should have occurred to me. There are a few ways I could get it back: Fun with pipes, PID’s, and file descriptors using GDB (example here); parsing and passing the results as a passive host check to the Nagios external command file (might make sense since check_mk submits results as passive checks anyway). Probably others. At this juncture, I will probably at least test with the setuid bit set, and perhaps just leave it that way.
“A politician thinks of the next election. A statesman thinks of the next generation.”
–James Freeman Clarke
“Time is what we want most, but what we use worst.”
–William Penn
A fitting and appropriate quote for the day, as I am attempting to do some time tracking to see just where my time is going. It will be interesting to see if I can stay sufficiently engaged in any one area for long enough periods to get anything meaningful from it.
If people are good only because they fear punishment, and hope for reward, then we are a sorry lot indeed. — Albert Einstein
Do you want to know who you are? Don’t ask. Act! Action will delineate and define you. — Thomas Jefferson
“Let every nation know, whether it wishes us well or ill, that we shall pay any price, bear any burden, meet any hardship, support any friend, oppose any foe to assure the survival and the success of liberty.” –John F. Kennedy
Write congressmen about debt ceiling, PROTECT IP act.
You are currently browsing the archives for the Quotes category.
