I intend to use the least privileged user to do a given task. The issue is that it involve a kind of responsibility chain and translate as a sudo
chain in my scripts, spreading the overall task in many places.
Sudoer file
"www-data" ALL = (webadmin) NOPASSWD: /home/webadmin/scripts/git-deploy.sh
"webadmin" ALL = (root) NOPASSWD: /root/scripts/copy-deploy ""
Details
To make the previous paragraph more tangible:
Some request is sent to Apache.
The worker is running as www-data
Through mod_php, the script /home/webadmin/scripts/git-deploy.sh
is launched using
<?php
exec('/'.escapeshellarg($gitRepo))
$gitRepo
is feed by the following script :
$bitBucketUrl=json_decode($request->getContent(),true);
if(isset($bitBucketUrl['url'])){
$bitBucketUrl=$bitBucketUrl['url'];
if(!preg_match('/\.git$/',$bitBucketUrl)){
$bitBucketUrl.='.git';
}
}else{
$result='bad url';
}
if(preg_match('/^[email protected]:TEAM\/[a-zA-Z0-9\.-]+\.git$/',$bitBucketUrl)){
exec(escapeshellcmd('sudo -u webadmin /home/webadmin/scripts/git-deploy.sh '.escapeshellarg($bitBucketUrl)),$results);
$result=$results;
}else{
$result=$bitBucketUrl;
}
Of course, the script /home/webadmin/scripts/git-deploy.sh
check $1
#!/bin/bash
valid=^[email protected]:TEAM/[a-zA-Z0-9-]+\.git$
if [[ $1 =~ $valid ]]; then
name=${1#[email protected]:TEAM/}
name=${name%.git}
fullName=/home/webadmin/websites/$name
if [[ -e $fullName ]] ; then
echo "$fullName exists, will do a git pull instead"
echo "cd $fullName && git pull"
else
echo "/usr/bin/git clone $1"
fi
if [[ -e $fullName/deploy/apache-conf/ ]]; then
#sudo -u root /root/scripts/copy-deploy
fi
fi
Note: I know that it is only echoing, this is the test version with dummy users.
Each script is only u+rwx
by his owner (700).
Question
- Is spreading the scripts in various places playing against security? (Harder to grasp what is going on)
- Do you see something else wrong?