0

I am able to jail specific commands execution by a proxy script to a user whose sudo privilege is only this script sodo check here for how to. Also the sodo script logs whatever critical commands they ordered:

sodo:

#!/bin/bash
# pass command by non-sudoers who can only run some command via this script
case $1 in
  firewall-cmd|ip|systemctl)
    #echo $*
    eval $*
    ret=$?
    ;;
  *)
     echo 'your request is not allowed yet, please contact the root user'
     exit 1
     ;;
esac

if [ $ret -eq 0 ];then
  echo `date +"%Y-%m-%d %X"`": executed order from" `pwd` "by pid" $$ "to" $* >> /root/sodo.log
fi

You might argue the script above does not log the exact user by $USER who runs firewall-cmd|ip|systemctl. Correct, it is because they run sodo as the root user, and $USER=root so that those 3 would allow them to run given that their sudo privilege does not include the 3.

But here is the loop hole - they can run sodo inside a python script inside some public path like var and it is impossible to pin down who runs it (who stopped the service maliciously). Now that I have recorded $$ the pid to run sodo, is it possible to trace back the parent pid's back to the login process to pin down who was the actual commander?

I figure out a way to trace back its parent user while this script is being processed - since its parent process is not dead yet and $$ can trace everything about it by ps and basic search, it is possible to log the user of its parent process, who was the real commander on this script.

George Y
  • 528
  • 6
  • 16
  • 4
    You seem to be reimplementing `sudo` capabilities in the script. `sudo` can restrict allowed commands on its own and also does log commands in `auth.log`. Also you want to look into `auditd`. – AlexD Jul 19 '23 at 05:36
  • 1
    What could go wrong by passing `ip ; poweroff` as parameters to `eval $*`? – A.B Jul 19 '23 at 19:35
  • @A.B it could go wrong, so I log the call in the end, and `poweroff` is not included in the first condition. You could elaborate the conditions by adding more control flow lines. – George Y Jul 24 '23 at 07:42
  • The answer: eval will evaluate the command poweroff, while you only checked for the command ip. Never use the eval command provided with untrusted data – A.B Jul 24 '23 at 15:38

0 Answers0