Designate per-user(group) capabilities in sudoers file
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 20/100
- Issue type
- Feature
- Clarity
- Needs clarification
- Activity status
- Stale
- Tech stack
- c, linux
- Domain
- authorization, security
Research direction
The issue proposes adding capability controls to sudoers, with possible NETCTL and RAWIO settings, but does not identify files, tests, or a settled design. First read the sudoers documentation and implementation, then investigate how sudo currently handles NOEXEC and platform or kernel compatibility. Done means a compatible design and implementation with tests for the chosen capability settings.
Written by the indexing model from the issue text.
Description
Rationale:
Enable per-user(group) Linux capabilities(7) like feature in the sudoers file. While tools like setcap exist, they do not offer the same ease of use and integration with sudo's centralized access control model. sudoers configuration allows for granular command control but currently lacks the ability to specify capabilities categories besides NOEXEC.
Proposed Feature
Extend sudoers syntax to allow specifying capabilities for commands. These commands should be carefully designed to remain compatible with other platforms and older Linux kernel versions.
Some initial considerations for possible commands:
- (NO)NETCTL: controls the administration of IP firewall, modify routing tables, raw sockets, bind a socket to Internet domain privileged ports.
- (NO)RAWIO: Performing raw IO to various devices.
I'm pretty unsure whether it is feasible to provide such features under different platforms and maintain high compatibility.
- Dominant language
- C
- Stars
- 1.7k
- Forks
- 306
- Avg merge
- 1d 2h
- Merged PRs (30d)
- 22
Getting set up
This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from sudo-project/sudo
-
Difficulty 4/5 3-5 days Newbie friendliness 42/100
sudo-project/sudo#583 ·
Maintainers usually reply within 1 day
-
Difficulty 4/5 3-5 days Newbie friendliness 45/100
sudo-project/sudo#581 · 4 comments ·
Maintainers usually reply within 1 day
-
Signal forwarded to the command is lost when it arrives between fork() and execve() of the commandOpen
Difficulty 4/5 3-5 days Newbie friendliness 35/100
sudo-project/sudo#566 ·
Maintainers usually reply within 1 day
-
Difficulty 3/5 1-2 days Newbie friendliness 52/100
sudo-project/sudo#553 ·
Maintainers usually reply within 1 day
-
Difficulty 4/5 3-5 days Newbie friendliness 48/100
sudo-project/sudo#552 ·
Maintainers usually reply within 1 day
All issues in sudo-project/sudo
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
CanadaHonk/porffor#426 ·
-
Difficulty 1/5 Under an hour Newbie friendliness 77/100
raysan5/raylib.com#132 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
libsdl-org/SDL#16607 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
PowerShell/Win32-OpenSSH#2482 · 1 reaction ·
-
needs-triage
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
SoftEtherVPN/SoftEtherVPN#2322 ·
Maintainers usually reply within 1 day