Usage of sudo

[michael-o]

Mandatory info for bug reports:

FreeBSD version ( uname -a ): 12.2-STABLE r365640 GENERIC amd64

CBSD version ( cbsd version ): 12.2.0

From the documentation it is not clear at what point and how sudo is required. It does not say whether I need to run everything as root or login as cbsd user or someone else in the cbsd group. Moreover, I receive at any case: sudo: sudoers specifies that root is not allowed to sudo. It seems like there are nested commands trying to sudo over and over again.

Please clarify what your requirements for sudo are and how it is used with CBSD. Coming from ezjail, I simply run everything als root. My sudo port says: [x] DISABLE_ROOT_SUDO.

[olevole]

sudo is necessary and used in cases when you work with a remote machine: jcoldmigrate, jrclone, bhyve live migration..
Instead of allowing root access in SSH, we use connections from the cbsd user, who has a limited list of commands to run from sudo ( /usr/local/cbsd/sudoexec , see: /usr/local/etc/sudoers.d/10_cbsd_sudoers )

ps: nested sudo need to fix, I agreed

[olevole]

maybe we can add a check/prevent nested sudo via environment test ( it seems sudo is adding environment variables ) or getuid - it needs to be investigated

[olevole]

btw, @michael-o for what cases do you need DISABLE_ROOT_SUDO ? it seems to me that a huge number of scripts have a call to sudo, especially in Linux land ;)

[olevole]

with SUDO env, maybe something like that, e.g:

diff -ruN /usr/local/cbsd/tools/xen-exist.bak /usr/local/cbsd/tools/xen-exist
?

--- /usr/local/cbsd/tools/xen-exist.bak 2020-10-08 18:04:19.799049000 +0300
+++ /usr/local/cbsd/tools/xen-exist     2020-10-30 08:48:46.562142000 +0300
@@ -2,4 +2,6 @@
 # xen xl list req for locked memory
 # https://lists.freebsd.org/pipermail/freebsd-xen/2015-May/002391.html
 # use "sudo -c -" for default class
-exec /usr/local/bin/sudo -c - -E /usr/local/cbsd/sudoexec/xen-exist $*
+
+[ -z "${SUDO_USER}" ] && SUDO_REQ="/usr/local/bin/sudo -c - -E"
+exec ${SUDO_REQ} /usr/local/cbsd/sudoexec/xen-exist $*

[lbartoletti]

BTW, can you add an option to use doas instead of sudo ? :)

Thanks.

[olevole]

@lbartoletti the last time i check doas i didn't know how to do some things: #83 (comment)

[michael-o]

btw, @michael-o for what cases do you need DISABLE_ROOT_SUDO ? it seems to me that a huge number of scripts have a call to sudo, especially in Linux land ;)

Well, I don't use Linux except for Oracle, everything else happens on FreeBSD and HP-UX. I can't really remember why I have enabled this, but I see no reason why root needs sudo unless he wants to run something as another user to obtain permissions. I have disabled this for now and the commands do work. As you have said, a lot of scripts use exec sudo explictly.
The question remains: It lacks clear documentation which user should be used explicitly to run all commands. The sudoers file simply says that cbsd can elevate permissions for a specific set, that's it. I am a bit uncertain how to properly use the cbsd command.

[olevole]

The question remains: It lacks clear documentation which user should be used explicitly to run all commands.

You will not be able to use CBSD via any other user except 'root', the system answers this question):

oleg@t495s:~ % whoami
oleg

oleg@t495s:~ % cbsd jls
/usr/local/bin/cbsd: Permission denied.

A lot of actions require root ( zfs create/destroy, run bhyve/jail, create/destroy tap interface, create vale, snapshots ), so unprivileged user (as in ezjail) will not be able to create environments.

What can we improve?

1. Probably to supplement the documentation on the purpose of the /usr/local/cbsd/sudoexec/ directory when remote action used.

2. Remove unnecessary launch of sudo if we are root.

[michael-o]

The question remains: It lacks clear documentation which user should be used explicitly to run all commands.

You will not be able to use CBSD via any other user except 'root', the system answers this question):

oleg@t495s:~ % whoami
oleg

oleg@t495s:~ % cbsd jls
/usr/local/bin/cbsd: Permission denied.

I have noticed this already the hard way ;-)

A lot of actions require root ( zfs create/destroy, run bhyve/jail, create/destroy tap interface, create vale, snapshots ), so unprivileged user (as in ezjail) will not be able to create environments.

ezjail requires me to be root too. Anything else wouldn't make sense w/o root privs.

What can we improve?

Several points from my opinion.

1. Probably to supplement the documentation on the purpose of the /usr/local/cbsd/sudoexec/ directory when remote action used.

Exactly, the cbsd account is solely for remote management and not direct, interactive usage. One shall not log in as cbsd.

2. Remove unnecessary launch of sudo if we are root.

Yes please, by detecting uid?

3. Explicitly document that all commands require root privs. Either root directy or someone from wheel with entry in sudoers.
4. All documentation uses % (old style, new style $) as prompt which implies a non-priv'ed user as opposed to #.

Thank you very much for your time.

[olevole]

cbsd/cbsd-wwwdoc@9fe97f6

[olevole]

getuid syscall or whoami/who/... is more difficult for a shell than checking an environment variable. I hope there is no problem with the uniqueness of the variable: f93cc9e

[michael-o]

Great thank you, this is just fine. Really appreciate it!