Skip to content

chore(security): Try using pkexec instead of sudo #550

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
gmpinder wants to merge 1 commit into
base: main
Choose a base branch
from
Draft

chore(security): Try using pkexec instead of sudo #550

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 2 additions & 3 deletions process/drivers/bootc_driver.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,14 +12,14 @@

pub use status::*;

const SUDO_PROMPT: &str = "Password needed to run bootc";

Check failure on line 15 in process/drivers/bootc_driver.rs

View workflow job for this annotation

GitHub Actions / test / docker-build 

constant `SUDO_PROMPT` is never used

Check failure on line 15 in process/drivers/bootc_driver.rs

View workflow job for this annotation

GitHub Actions / test / rechunk-build 

constant `SUDO_PROMPT` is never used

Check failure on line 15 in process/drivers/bootc_driver.rs

View workflow job for this annotation

GitHub Actions / test / buildah-build 

constant `SUDO_PROMPT` is never used

Check failure on line 15 in process/drivers/bootc_driver.rs

View workflow job for this annotation

GitHub Actions / test / arm64-build 

constant `SUDO_PROMPT` is never used

Check failure on line 15 in process/drivers/bootc_driver.rs

View workflow job for this annotation

GitHub Actions / test / empty-files-build 

constant `SUDO_PROMPT` is never used

Check failure on line 15 in process/drivers/bootc_driver.rs

View workflow job for this annotation

GitHub Actions / test / iso-from-image 

constant `SUDO_PROMPT` is never used

Check failure on line 15 in process/drivers/bootc_driver.rs

View workflow job for this annotation

GitHub Actions / test / docker-build-external-login 

constant `SUDO_PROMPT` is never used

Check failure on line 15 in process/drivers/bootc_driver.rs

View workflow job for this annotation

GitHub Actions / test / podman-build 

constant `SUDO_PROMPT` is never used

Check failure on line 15 in process/drivers/bootc_driver.rs

View workflow job for this annotation

GitHub Actions / test / iso-from-recipe 

constant `SUDO_PROMPT` is never used

pub struct BootcDriver;

impl BootDriver for BootcDriver {
fn status() -> Result<Box<dyn BootStatus>> {
let output = {
let c = sudo_cmd!(prompt = SUDO_PROMPT, "bootc", "status", "--format=json");
let c = sudo_cmd!("bootc", "status", "--format=json");
trace!("{c:?}");
c
}
Expand Down Expand Up @@ -47,7 +47,6 @@
fn switch(opts: SwitchOpts) -> Result<()> {
let status = {
let c = sudo_cmd!(
prompt = SUDO_PROMPT,
"bootc",
"switch",
"--transport=containers-storage",
Expand All @@ -71,7 +70,7 @@

fn upgrade(opts: SwitchOpts) -> Result<()> {
let status = {
let c = sudo_cmd!(prompt = SUDO_PROMPT, "bootc", "upgrade");
let c = sudo_cmd!("bootc", "upgrade");
trace!("{c:?}");
c
}
Expand Down
12 changes: 0 additions & 12 deletions process/drivers/podman_driver.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@
signal_handler::{ContainerRuntime, ContainerSignalId, add_cid, remove_cid},
};

const SUDO_PROMPT: &str = "Password for %u required to run 'podman' as privileged";

Check failure on line 36 in process/drivers/podman_driver.rs

View workflow job for this annotation

GitHub Actions / test / docker-build 

constant `SUDO_PROMPT` is never used

Check failure on line 36 in process/drivers/podman_driver.rs

View workflow job for this annotation

GitHub Actions / test / rechunk-build 

constant `SUDO_PROMPT` is never used

Check failure on line 36 in process/drivers/podman_driver.rs

View workflow job for this annotation

GitHub Actions / test / buildah-build 

constant `SUDO_PROMPT` is never used

Check failure on line 36 in process/drivers/podman_driver.rs

View workflow job for this annotation

GitHub Actions / test / arm64-build 

constant `SUDO_PROMPT` is never used

Check failure on line 36 in process/drivers/podman_driver.rs

View workflow job for this annotation

GitHub Actions / test / empty-files-build 

constant `SUDO_PROMPT` is never used

Check failure on line 36 in process/drivers/podman_driver.rs

View workflow job for this annotation

GitHub Actions / test / iso-from-image 

constant `SUDO_PROMPT` is never used

Check failure on line 36 in process/drivers/podman_driver.rs

View workflow job for this annotation

GitHub Actions / test / docker-build-external-login 

constant `SUDO_PROMPT` is never used

Check failure on line 36 in process/drivers/podman_driver.rs

View workflow job for this annotation

GitHub Actions / test / podman-build 

constant `SUDO_PROMPT` is never used

Check failure on line 36 in process/drivers/podman_driver.rs

View workflow job for this annotation

GitHub Actions / test / iso-from-recipe 

constant `SUDO_PROMPT` is never used

#[derive(Debug, Deserialize)]
struct PodmanVersionJsonClient {
Expand Down Expand Up @@ -61,7 +61,6 @@
let image = image.whole();
let status = {
let c = sudo_cmd!(
prompt = SUDO_PROMPT,
"podman",
"image",
"scp",
Expand Down Expand Up @@ -120,7 +119,6 @@
.wrap_err("Failed to create temporary directory for secrets")?;

let command = sudo_cmd!(
prompt = SUDO_PROMPT,
sudo_check = opts.privileged,
"podman",
"build",
Expand Down Expand Up @@ -175,7 +173,6 @@
let dest_image_str = opts.dest_image.to_string();

let mut command = sudo_cmd!(
prompt = SUDO_PROMPT,
sudo_check = opts.privileged,
"podman",
"tag",
Expand All @@ -200,7 +197,6 @@
let image_str = opts.image.to_string();

let command = sudo_cmd!(
prompt = SUDO_PROMPT,
sudo_check = opts.privileged,
"podman",
"push",
Expand Down Expand Up @@ -290,7 +286,6 @@
fn mount_container(opts: ContainerOpts) -> Result<MountId> {
let output = {
let c = sudo_cmd!(
prompt = SUDO_PROMPT,
sudo_check = opts.privileged,
"podman",
"mount",
Expand All @@ -314,7 +309,6 @@
fn unmount_container(opts: ContainerOpts) -> Result<()> {
let output = {
let c = sudo_cmd!(
prompt = SUDO_PROMPT,
sudo_check = opts.privileged,
"podman",
"unmount",
Expand All @@ -336,7 +330,6 @@
fn remove_volume(opts: VolumeOpts) -> Result<()> {
let output = {
let c = sudo_cmd!(
prompt = SUDO_PROMPT,
sudo_check = opts.privileged,
"podman",
"volume",
Expand Down Expand Up @@ -401,7 +394,6 @@

let output = {
let c = sudo_cmd!(
prompt = SUDO_PROMPT,
sudo_check = opts.privileged,
"podman",
"create",
Expand All @@ -428,7 +420,6 @@

let output = {
let c = sudo_cmd!(
prompt = SUDO_PROMPT,
sudo_check = opts.privileged,
"podman",
"rm",
Expand All @@ -452,7 +443,6 @@

let output = {
let c = sudo_cmd!(
prompt = SUDO_PROMPT,
sudo_check = opts.privileged,
"podman",
"rmi",
Expand Down Expand Up @@ -482,7 +472,6 @@

let output = {
let c = sudo_cmd!(
prompt = SUDO_PROMPT,
sudo_check = privileged,
"podman",
"images",
Expand Down Expand Up @@ -515,7 +504,6 @@

fn podman_run(opts: RunOpts, cid_file: &Path) -> Command {
let command = sudo_cmd!(
prompt = SUDO_PROMPT,
sudo_check = opts.privileged,
"podman",
"run",
Expand Down
73 changes: 4 additions & 69 deletions utils/src/macros.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -83,7 +83,6 @@ macro_rules! impl_de_fromstr {
#[macro_export]
macro_rules! sudo_cmd {
(
prompt = $prompt:expr,
sudo_check = $sudo_check:expr,
$command:expr,
$($rest:tt)*
Expand All @@ -93,52 +92,19 @@ macro_rules! sudo_cmd {

::comlexr::cmd!(
if _use_sudo {
"sudo"
"pkexec"
} else {
$command
},
if _use_sudo && $crate::has_env_var($crate::constants::SUDO_ASKPASS) => [
"-A",
"-p",
$prompt,
],
if _use_sudo => [
"--preserve-env",
$command,
],
$($rest)*
)
}
};
(
sudo_check = $sudo_check:expr,
$command:expr,
$($rest:tt)*
) => {
{
let _use_sudo = ($sudo_check) && !$crate::running_as_root();

::comlexr::cmd!(
if _use_sudo {
"sudo"
} else {
$command
},
if _use_sudo && $crate::has_env_var($crate::constants::SUDO_ASKPASS) => [
"-A",
"-p",
$crate::constants::SUDO_PROMPT,
],
if _use_sudo => [
"--preserve-env",
"--keep-cwd",
$command,
],
$($rest)*
)
}
};
(
prompt = $prompt:expr,
$command:expr,
$($rest:tt)*
) => {
Expand All @@ -147,43 +113,12 @@ macro_rules! sudo_cmd {

::comlexr::cmd!(
if _use_sudo {
"sudo"
"pkexec"
} else {
$command
},
if _use_sudo && $crate::has_env_var($crate::constants::SUDO_ASKPASS) => [
"-A",
"-p",
$prompt,
],
if _use_sudo => [
"--preserve-env",
$command,
],
$($rest)*
)
}
};
(
$command:expr,
$($rest:tt)*
) => {
{
let _use_sudo = !$crate::running_as_root();

::comlexr::cmd!(
if _use_sudo {
"sudo"
} else {
$command
},
if _use_sudo && $crate::has_env_var($crate::constants::SUDO_ASKPASS) => [
"-A",
"-p",
$crate::constants::SUDO_PROMPT,
],
if _use_sudo => [
"--preserve-env",
"--keep-cwd",
$command,
],
$($rest)*
Expand Down
Loading