[arch-devops] restricting sudoers PATH

[Giancarlo Razzolini]

Em setembro 3, 2019 11:35 Jelle van der Waa escreveu:
> Thanks to anthraxx, we now restrict the PATH which `sudo
> extra-x86_64-build` and other sudoers specific infra uses using
> restrict_path. To circumvent users overridding their own PATH with tools
> which are used in our build scripts which basically allows privilege
> escalation. [1]
> 
> This shouldn't cause any issues, if they do contact me or anthraxx.
> 
> [1] https://git.archlinux.org/infrastructure.git/commit/?id=1eb1dd41f8c734380a38609f2ae3cb2d37ea1dce
> 

Thanks guys. Step by step we're hardening our roles. Next step, separate /usr mounted with nosuid.
Next, next step, restricting sudoers even further.

Cheers,
Giancarlo Razzolini
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <https://lists.archlinux.org/pipermail/arch-devops/attachments/20190903/334b835f/attachment.sig>