please, a sudo clone with regex support
Great! This is what I needed.
The aim is to allow admins to delegate accurate least privilege access with ease. There are times when what is intended to be executed can be expressed easily with a regex to expose only what is needed and nothing more.
how do i install it
A simple install:
git clone https://gitlab.com/edneville/please.git
cd please
cargo test && cargo build --release \
&& cp target/release/please target/release/pleaseedit /usr/local/bin \
&& chown root:root /usr/local/bin/please /usr/local/bin/pleaseedit
&& chmod 4755 /usr/local/bin/please /usr/local/bin/pleaseedit
how do i set it up
Next, configure your /etc/please.ini
similar to this, replace user names with appropriate values. One of the simplest, that does not require password authentication can be defined as follows, assuming the user is ed
:
The options are as follows:
part | effect |
---|---|
[section-name] | Section name, naming sections may help you later. |
name=regex | Mandatory, apply configuration to this entity. |
target=regex | May become these users. |
permit=[true | false] |
require_pass=[true/false] | Defaults to true, mandatory in run and edit, become this user. |
regex=rule | Mandatory, this is the regex for the section. |
notbefore | The date, in YYYYmmdd or YYYYmmddHHMMSS when this rule becomes effective. |
notafter | The date, in YYYYmmdd or YYYYmmddHHMMSS when this rule expires. |
list=[true/false] | Permit listing of users matching the regex rule. |
edit=[true/false] | Permit editing of files matching the regex rule as the target user. |
group=[true/false] | True to signify that name= refers to a group rather than a user. |
hostname=regex | Hosts where this applies. Defaults to 'localhost'. |
dir=regex | Permit switching to regex defined directory prior to execution. |
include=file | Include file as another ini source, other options will be skipped in this section. |
includedir=dir | Include dir of .ini files as other sources, in ascii sort order other options will be skipped in this section. Files not matching .ini will be ignored to allow for editor tmp files. |
include
and includedir
will override mandatory arguments.
Using a greedy .*
for the regex field will be as good as saying the rule should match any command. In previous releases there was no anchor (^
and $
) however, it seems more sensible to follow find
's approach and insist that there are anchors around the regex. This avoids /bin/bash
matching /home/user/bin/bash
unless the rule permits something like /home/%{USER}/bin/bash
.
If a include
directive is met, no other enties in the section will be processed. The same goes for includedir
.
The ordering of rules matters. The last match will win. Set permit=false
if you wish to exclude something, but this should be very rare as the permit should be against a regex rather than using a positive and then a negative match. A rule of best practice is to avoid a fail open and then try and exclude most of the universe.
For example, using the two entries below:
[ed_root_du]
user=ed
target=root
permit=true
regex = ^(/usr)?/bin/du\s.*
require_pass=false
[ed_postgres]
user=ed
target=postgres
permit=true
regex = /bin/bash
require_pass=false
Would permit running du
, as /usr/bin/du
or /bin/du
as root
:
$ please du /home/*
And would also permit running a bash shell as postgres
:
$ please -t postgres /bin/bash
postgres$
dated ranges
For large environments it is not unusual for a third party to require access during a short time frame for debugging. To accommodate this there are the notbefore
and notafter
time brackets. These can be either YYYYMMDD
or YYYYMMDDHHMMSS
.
The whole day is considered when using the shorter date form of YYYYMMDD
.
Many enterprises may wish to permit access to a user for a limited time only, even if that individual is in the role permanently.
pleaseedit
pleaseedit
enables editing of files as another user. Enable editing rather than execution with edit=true
. The first argument will be passed to EDITOR
.
This is performed as follows:
- user runs edit as
pleaseedit -u root /etc/fstab
/etc/fstab
is copied to/tmp/fstab.pleaseedit.tmp
- user's
EDITOR
is executed against/tmp/fstab.pleaseedit.tmp
- if
EDITOR
exits 0 then/tmp/fstab.pleaseedit.tmp
is copied to/etc/fstab.pleaseedit.tmp
/etc/fstab.pleaseedit.tmp
is set as root owned andrenamed
to/etc/fstab
other examples
Members of the audio
group may remove temporary users that an application may not have cleaned up in the form of username_tmp.<10 random alphanumerics>
using userdel
:
[user_remove_tmp_user]
name = audio
group = true
permit = true
require_pass = false
regex = /usr/sbin/userdel -f -r %{USER}_tmp\.[a-zA-Z0-9]{10}
How about, for the purpose of housekeeping, some users may be permitted to destroy zfs snapshots that look roughly like they're date stamped:
[user_remove_snapshots]
name = data
group = true
permit = true
require_pass = false
regex = /usr/sbin/zfs destroy storage/photos@\d{8}T\d{6}
To list what you may or may not do:
$ please -l
You may run the following:
file: /etc/please.ini
ed_root_list:root: ^.*$
You may edit the following:
file: /etc/please.ini
ed_edit_ini:root: ^/etc/please.ini$
The above output shows that I may run anything and may edit the please.ini
configuration.
Or, perhaps any user who's name starts admin
may execute useradd
and userdel
:
[admin_users]
name = admin_\S+
permit = true
require_pass = false
regex = /usr/sbin/user(add|del)\s.*
files
/etc/please.ini
contributions
I welcome pull requests with open arms.
locations
The source code for this project is currently hosted on gitlab and mirrored to github. There is a crate on crates.io. It also has a homepage where other project information is kept.
why pleaser in some circles?
This project is named "please". In some places that project name was used by others for other things. Some packages will be named pleaser, some will be named please. The only important thing is if you wish someone to make you a sandwich, just say "please" first.
todo
[ ] read links on source of edits and don't stray outside of permitted rule
[ ] docker image for testing
[ ] plugins/modules
[ ] include readpart .d files
[ ] packages