investigate reducing need for sudo in verified mode |
|||
Issue descriptionsudo is setuid root. while we want to keep this around for dev mode users, killing it off in non-dev mode is desirable to reduce exploitation angles. first attempt was to mount /bin/false over top of it: https://chromium-review.googlesource.com/507991 but that broke a few users and was reverted via issue 724937 . grepping in platform2/ shows a few weird uses of sudo that we should be able to kill off by using different commands/approaches. but rather than reland CL:507991, we should install a script/program that logs+crashes attempts to use rather than silently exit(1). that way we'll have tangible details to track and help with triage.
,
Jun 6 2018
The following revision refers to this bug: https://chromium.googlesource.com/chromiumos/platform2/+/74e546e71bafade7ca8b90e9b2e2c88a68a743a2 commit 74e546e71bafade7ca8b90e9b2e2c88a68a743a2 Author: Mike Frysinger <vapier@chromium.org> Date: Wed Jun 06 08:16:23 2018 init: chromeos-cleanup-logs: drop sudo usage This script already runs as root, so there's no need to use sudo. BUG=chromium:725678 TEST=precq passes Change-Id: I14667db62a7730aa208a80a7d7bcb7fa69210880 Reviewed-on: https://chromium-review.googlesource.com/1087413 Commit-Ready: Mike Frysinger <vapier@chromium.org> Tested-by: Mike Frysinger <vapier@chromium.org> Reviewed-by: Dan Erat <derat@chromium.org> [modify] https://crrev.com/74e546e71bafade7ca8b90e9b2e2c88a68a743a2/init/chromeos-cleanup-logs
,
Jun 21 2018
The following revision refers to this bug: https://chromium.googlesource.com/chromiumos/platform2/+/e615bc37be6f86797251ba5ea3c26d46304c96a1 commit e615bc37be6f86797251ba5ea3c26d46304c96a1 Author: Micah Morton <mortonm@chromium.org> Date: Thu Jun 21 19:17:56 2018 chromeos-common-script: call sudo only when needed Run sudo only when non-root. When root, just /sbin to path to be sure command will run. BUG=chromium:725678 TEST=Check build image and chromeos-install still work Run try-bot eve-arcnext Change-Id: I60965f6515aa80541abc680d7c1d5501051b1eac Signed-off-by: Gwendal Grignou <gwendal@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/1107483 Reviewed-by: Mike Frysinger <vapier@chromium.org> [modify] https://crrev.com/e615bc37be6f86797251ba5ea3c26d46304c96a1/chromeos-common-script/share/chromeos-common.sh
,
Jul 2
,
Aug 2
|
|||
►
Sign in to add a comment |
|||
Comment 1 by jorgelo@chromium.org
, Jun 4 2017