Bug 1848229
| Summary: | ipa sudorule allows deny commands with usercat=all | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | xifan |
| Component: | ipa | Assignee: | Florence Blanc-Renaud <frenaud> |
| Status: | CLOSED DEFERRED | QA Contact: | ipa-qe <ipa-qe> |
| Severity: | low | Docs Contact: | |
| Priority: | low | ||
| Version: | 7.6 | CC: | pcech, rcritten, tscherf |
| Target Milestone: | rc | Keywords: | Triaged |
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2021-02-19 07:54:43 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Comment 2
Rob Crittenden
2020-06-24 15:13:35 UTC
Upstream ticket: https://pagure.io/freeipa/issue/8382 RHEL-7.9 is already past the end of a Development Phase and development is being wrapped up. This bug is being moved to RHEL 7.9 z-stream. I would be in favor of closing this as not a bug.
The sudoers man page, especially the SECURITY NOTES section, details the differences between
ALL = ALL, !<deny command>
and
ALL = !<deny command>
in the /etc/sudoers file.
----- 8< -----
Limitations of the ‘!’ operator
It is generally not effective to “subtract” commands from ALL using the
‘!’ operator. A user can trivially circumvent this by copying the
desired command to a different name and then executing that. For exam‐
ple:
bill ALL = ALL, !SU, !SHELLS
Doesn't really prevent bill from running the commands listed in SU or
SHELLS since he can simply copy those commands to a different name, or
use a shell escape from an editor or other program. Therefore, these
kind of restrictions should be considered advisory at best (and rein‐
forced by policy).
In general, if a user has sudo ALL there is nothing to prevent them from
creating their own program that gives them a root shell (or making their
own copy of a shell) regardless of any ‘!’ elements in the user specifi‐
cation.
----- >8 -----
but both are supported.
With cmdcat=all and a sudo-deny-command, the behavior is equivalent to ALL, !<deny cmd>:
$ ipa sudorule-show mysudorule
Rule name: mysudorule
Enabled: TRUE
Host category: all
Command category: all
RunAs User category: all
RunAs Group category: all
Users: idmuser
Sudo Deny Commands: cat
$ sudo -l
[...]
User idmuser may run the following commands on server:
(ALL : ALL) ALL, !cat
^^^^^^^^^
while with cmdcat not specified and sudo-deny-command, the behavior is equivalent to !<deny cmd>:
$ ipa sudorule-show mysudorule
Rule name: mysudorule
Enabled: TRUE
Host category: all
RunAs User category: all
RunAs Group category: all
Users: idmuser
Sudo Deny Commands: cat
$ sudo -l
[...]
User idmuser may run the following commands on server:
(ALL : ALL) !cat
^^^^
Moreover, the code in ipa was intentionally modified to allow this type of config, please see commit https://pagure.io/freeipa/c/af2eb4d69506b641504d076e79b80c7ee54eeda9 related to issue https://pagure.io/freeipa/issue/4340
Red Hat Enterprise Linux 7 is in Maintenance Support 2 Phase. This bug was reevaluated and will be closed as it doesn’t meet the Maintenance Support 2 phase criteria, specifically: “Critical and Important impact Security Advisories (RHSAs) and selected (at Red Hat discretion) Urgent Priority Bug Fix Advisories (RHBAs)" Thank you for understanding. Red Hat Enterprise Linux Identity Management Team |