Is there a criteria for allowing or disallowing the execution of bash scripts as root with sudo?

Question

What criteria could I take in order to to allow or disallow the execution of bash scripts with sudo as root?

I know I should analyze the script but I have not enough time and I trust my developers.

My criteria today is to request the script user owner, group owner and permissions just to be sure the owner and group are root and permissions don't allow the user to modify the script.

For example, is there any tool in order to extract the commands executed within a bash script? I think with this list of command I would be able to evaluate if all command requiere root privileges or not.

Answer 1

A few options:

• Read through the script once, make it r-x, change ownership, and add the script to the sudoers entry for the developers
• Require that the developers use sudo in the script, rather than on executing the script, and whitelist commands in the sudoers file
• Trust your developers and accept the risk

As far as extracting commands, there's only one right way to do that: read the script. You could turn on auditing or read the command history or something, but if it's truly malicious, those can't be relied upon.

Answer 2

I had same issue with SQL script launched with power-user (not exactly root, but close). So I made a list of commands that would arm my database, and maintained this list over time.

You may maintain a list of forbidden commands - we can't say what you want to avoid, but it seems hard to me to forbid rm.. you may just raise a warning when you do your checking.

So the idea would be to have a grep command do that for you - here it uses a list of patterns in pattern_file, and -r in case you have sub-directories to search:

grep -f pattern_file.txt -r /sudo_shells_repo/* 

Have this run as a verification script each time someone come and add an "executable with sudo" script in the repository.

Answer 3

is there any tool in order to extract the commands executed within a bash script

Yes - bash.

But slightly less facetiously, no. Even an instrumented version the command interpreter will only show you what the script has done after it has done it. And treating the script as a black box means you can never be sure about what it will do in future, even assuming you can accurately capture the before and after states of running the script.

 stuff='tmp/deletme'

 if [ ! -d "/home/disgruntled" ] ; then 
    unset stuff
 fi

 rm -rf "$stuff/"

Answer 4

extract the commands executed within a bash script?

You are effectively trying to match the code against a set of known bad signatures, similar to what IDS and antivirus do in the simplest case. But this does not work because bash is a very capable language where you can dynamically create commands and execute these. This can not be found by a simple pattern matching.

For example the following will execute bash -i, i.e. an interactive shell which provides the attacker with a privileged shell when executed with sudo.

foo=bas
bar='h -i'
$foo$bar

Even if you create a signature for this code it can be easily modified so that it does not match the signature any longer. Or that the signature matches also valid code, i.e. false positive. And if you are trying a more advanced dynamic analyses it is also possible to make this code depend on time or files or just read new commands directly from a file or socket etc.

Conclusion: No script should be authorized without manual analysis.