This is extremely insecure. I'm glad you asked elsewhere before running this setup yourself! I hope those 3000+ people on AskUbuntu were similarly cautious. So, why is this insecure? What can an attacker do if you put them in the group? That group will be able to elevate privileges to root. The reason is simple: VeraCrypt allows mounting an encrypted volume of arbitrary file permissions, using an arbitrary filesystem with arbitrary mount flags. Consider the following scenario:
An evil user is put in your special group, letting them run VeraCrypt as root without a password. This user wants to exploit your setup to get a root shell, allowing them to run commands other than
/usr/bin/veracrypt as root. Their final goal is simple: bypass the restrictions you have in place and run arbitrary commands as root.
An encrypted volume is created, owned and writable by the evil user. It is formatted, and a
bash binary is copied to the filesystem. As the volume is directly writable, the setuid bit can be set on the binary. This is normally impossible, but our attacker can modify the volume.
The evil user runs VeraCrypt as root and mounts the volume to
/mnt (a normally privileged operation). They run
/mnt/bash and get a root shell, from which they are able to execute any command as a privileged user. They have their root shell and can execute anything they want.
Normally, a user-mountable filesystem will have several restrictions in place. Such filesystems are typically configured by mounting with the
user flag. According to the
Allow an ordinary user to mount the filesystem. The name of the mounting
user is written to mtab so that he can unmount the filesystem again. This
option implies the options noexec, nosuid, and nodev (unless overridden
by subsequent options, as in the option line user,exec,dev,suid).
When a filesystem is mounted by an unprivileged user this way, despite the fact that they can create a filesystem with a setuid executable, the system will not honor the setuid bit when the filesystem is mounted. VeraCrypt has no way of knowing all this, and happily mounts the writable filesystem as root, with full support for setuid binaries. This safeguard is bypassed, and the attackers gets root, despite you only allowing one "safe" command via sudoers.
I'm sure there are other possible attacks as well. Does your filesystem have any mount flags that, on their own, can give an attacker root? Can keyfiles or new volumes be written to arbitrary locations? If so, can their contents be chosen by the user? When you bypass an important safeguard, you suddenly must rely on the designers of VeraCrypt writing the program in such a way that it protects from a threat model they never even considered. Unlike the
mount program, which was designed from the start to be safe even when run as root by an unprivileged user, VeraCrypt had no such goals. The same considerations should apply to anything before you run it as root.