linux - How to prevent sudo users from running specific commands?

I have a very sensitive network setup and I really dont want to mess up with it. My network consists a bunch of users who are with sudo privilege.

I want to stop them from running

service NetworkManager restart
service network restart

commands.

Is there any way I can achieve this?

Answer

There are 1000 ways to run service network restart without doing sudo service network restart. Here is an example of what a naughty user might try:

$ echo "service network restart" > /tmp/hax
$ chmod a+x /tmp/hax
$ sudo /tmp/hax

If you provide users with the ALL command alias, and then try to create a blacklist, they will always be able to find a way around it. Blacklist bash, and they will use python. Blacklist python, and they will use Perl. Blacklist Perl, and they will use PHP. Nobody wants that!

If you really don't want someone to do something, you should do as Thomas says, and create a whitelist of things they are allowed to do.

---

An example of a small whitelist with an exclusion can be found near the bottom of man sudoers:

 pete           HPPA = /usr/bin/passwd [A-Za-z]*, !/usr/bin/passwd root

The user pete is allowed to change anyone's password except for root on the HPPA
machines.  Note that this assumes passwd(1) does not take multiple user names
on the command line.

(In fact this example from the manpage is unsafe and can be exploited to change root's password! See the comments below for how.)

We can try to adapt that to your case, to offer all service commands to the staff group, but exclude the service network commands that concern you:

%staff ALL =   /usr/sbin/service *,                            \
             ! /usr/sbin/service *network*,                    \
             ! /usr/sbin/service *NetworkManager*

(The ALL in that position refers to the Host_Alias, not the Cmnd_Alias - confusing isn't it?)

The user won't be able to run sudo bash or sudo tee or sudo wget or sudo /path/to/malicious_script. You can whitelist more admin commands for your users if you are careful. Just be specific!

Note: I added the * before the word network above, just in case a harmless flag is ever added to the service tool in the future. Let's imagine a --verbose flag was added in future, then users would be able to run the following:

$ sudo service --verbose network restart

So we need the * to consume any flags before the service name. The one disadvantage is that this might block other services which you don't actually mind users running, e.g. a service called safe-network or network-monitor would also be rejected.

---

Below you can find various attempts using rnano through sudo to let users edit a file or files. But really they are more complex and more dangerous than they should be.

A much simpler and safer solution is to change the group permissions on the specific files that you want to open edit rights for. Here are a couple of examples:

### Give steve the ability to edit his nginx config:
$ chgrp steve /etc/nginx/sites-available/steves_dodgy_project
$ chmod g+rw /etc/nginx/sites-available/steves_dodgy_project

### Let all members of the staff group edit the group_website config:
$ chgrp staff /etc/nginx/sites-available/group_website
$ chmod g+rw /etc/nginx/sites-available/group_website

If you need more fine-grained control (for example: access for just 3 users, but not all staff members) you can create a new group using the addgroup command, and add just a few users to it.

---

The remainder of this answer became an investigation into how easy it is to leave holes in your sudo configuration when trying to offer flexibility to your users. I would not recommend doing any of the following!

If you want to grant your users access to edit a specific file, you could try using rnano:

%staff ALL = /bin/rnano /etc/nginx/sites-available/host

rnano will only let them edit the file specified. That is important to prevent a malicious user from editing a different upstart service (for example /etc/init.d/urandom), and adding a line to it which would run service network restart.

Unfortunately I did not find a way to restrict rvim sufficiently (the user can still open any file using :e), so we are stuck with nano.

Unfortunately allowing users to edit multiple files is much harder...

---

1. Unsafe approaches

Be careful of wildcards! If you offer too much flexibility (or any flexibility), it can be exploited:

%staff ALL = /bin/rnano /etc/nginx/sites-available/*                # UNSAFE!

In this case, a malicious user would be able to edit any other upstart service script, and then run it:

$ sudo rnano /etc/nginx/sites-available/../../../any/file/on/the/system

(Sudo does actually prevent . and .. expansion on the command, but unfortunately not on the arguments.)

I was hoping something like this might work, but it is still insecure:

%staff ALL = /bin/rnano /etc/nginx/sites-available/[A-Za-z0-9_-]*   # UNSAFE!

Since sudo currently only offers glob patterns, that * will match anything - it is not a regexp!

(Edit: I did consider if you might get away with the above in your situation, because there are no sub-folders beneath sites-available. We did demand one char be matched after the folder, and /.. should fail after a filename. However this is not a workable solution, because rnano accepts multiple arguments. And anyway in general this would still be unsafe on a folder which had subfolders!)

Even if we have no subfolders, and we exclude any lines containing /../, the rule offering a * glob could still be exploited, because rnano accepts multiple arguments (cycling through them on , and the space is happily accepted by the * glob.

$ rnano /etc/nginx/sites-available/legal_file /then/any/file/on/the/system

2. Pushing the envelope (also ultimately unsafe)

So what if we reject any lines containing spaces, or attempting to reach /..? Then a final workable solution might be this:

# I tried hard to make this safe, but in the end I failed again.
# Please don't use this unless you are really smart or really stupid.

%staff ALL =   /bin/rnano /etc/nginx/sites-available/*,    \
             ! /bin/rnano */..*,                           \
             ! /bin/rnano /etc/nginx/sites-available/,     \
             ! /bin/rnano */.,                             \
             ! /bin/rnano * *

# CONCLUSION: It is still NOT SAFE if there are any subfolders, due to
# the bug in rnano described below.

We accept anything "under" the folder but we also reject any call to rnano if /.. or /. or are passed, or if the folder is targeted directly. (Technically the /. exclusion makes the /.. exclusion redundant, but I have left both in for clarity.)

I found the folder and the /. exclusions were needed because otherwise the user could target the folder itself. Now you might think rnano would block if pointed at a folder, but you would be wrong. Actually my version (2.2.6-1ubuntu1) starts up with a mild warning and an empty file, then on asks me to input any filename I like to save to, opening a new attack vector! Well at least it refused to overwrite an existing file (in the one test I did). Anyway, since there is no way to blacklist subfolders with sudo, we must conclude that this approach is again unsafe. Sorry users!

This discovery made me doubt the thoroughness of nano's "restricted" mode. They say a chain is only as strong as its weakest link. I am beginning to feel the combination of sudo blacklist black-magic and rnano may be no more secure than a chain of daisies.

3. Safe but limited approaches

Globs are very restricted - they don't let us match a character class multiple times. You could offer multiple file edits, if all your filenames have the same length (in this case host followed by a single digit):

%staff ALL = /bin/rnano /etc/nginx/sites-available/host[0-9]       # SAFE

But if you want to give the user access to edit various files, you may need to specify each and every file explicitly:

%staff ALL = /bin/rnano /etc/nginx/sites-available/hothost    \
             /bin/rnano /etc/nginx/sites-available/coldhost   \    # SAFE
             /bin/rnano /etc/nginx/sites-available/wethost    \
             /bin/rnano /etc/nginx/sites-available/steves_dodgy_project

Do not be tempted to use a * at any point. See sections 1. and 2. above for why! Remember: one small slip can compromise the whole superuser account, and the whole system.

4. Write your own argument checker (safety is now your responsibility)

I hope they will add regexp support to sudo in the future; it could solve a lot of problems if used correctly. But we may also need the ability to check the properties of arguments (to allow only files, only folders, or only certain flags).

But there is one alternative to create flexibility in sudo. Pass the buck:

%staff ALL = /root/bin/staffedit *

Then write your own staffedit script or executable to check if the arguments passed by the user are legal, and only carry out their request if they are.