[arch-devops] restricting sudoers PATH
grazzolini at archlinux.org
Tue Sep 3 16:36:00 UTC 2019
Em setembro 3, 2019 11:35 Jelle van der Waa escreveu:
> Thanks to anthraxx, we now restrict the PATH which `sudo
> extra-x86_64-build` and other sudoers specific infra uses using
> restrict_path. To circumvent users overridding their own PATH with tools
> which are used in our build scripts which basically allows privilege
> escalation. 
> This shouldn't cause any issues, if they do contact me or anthraxx.
>  https://git.archlinux.org/infrastructure.git/commit/?id=1eb1dd41f8c734380a38609f2ae3cb2d37ea1dce
Thanks guys. Step by step we're hardening our roles. Next step, separate /usr mounted with nosuid.
Next, next step, restricting sudoers even further.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Size: 833 bytes
Desc: not available
More information about the arch-devops