Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Ability to debug as a user with elevated permissions (root) locally and remotely #2005

Closed
bryonbaker opened this issue Jan 9, 2022 · 2 comments

Comments

@bryonbaker
Copy link

Is your feature request related to a problem? Please describe.
As a cross-platform developer I need connect from a Mac to a Linux host when developing software. Root accounts are disabled by default on all linux machines.
However, when developing software that must run as root I cannot run and debug the code as that user. This means I need to enable the root account on the linux hosts and connect as that user when developing software. This presents a significant security risk.

Describe the solution you'd like
The ability to configure a sudo when running/debugging code.

Describe alternatives you've considered
Enabling the root account on the remote host and connecting as root.

Additional context
None.

@gopherbot gopherbot added this to the Untriaged milestone Jan 9, 2022
@hyangah
Copy link
Contributor

hyangah commented Jan 10, 2022

In order to debug as a root, the debugger (dlv) must run as a root. Nether dlv, nor this extension aims to offer privilege escalation solutions.

In remote debugging, dlv on the remote machine is externally managed, not by this extension, so it's out of scope. Moreover, this extension just communicates with the dlv on the remote host with DAP, which is not designed for security. So I am afraid this extension is not the right layer for privilege escalation.

To debug as a root, as you already know, run dlv on the remote machine as a root (you may also need to set --only-same-user=false if the remote host is Linux) but protect access to the dlv server & the remote machine appropriately using proven security technologies.

For local debugging, this is tracked in #558. But, I want to emphasize that debugging as a root still needs to be done with great care.

@findleyr
Copy link
Contributor

@hyangah if I'm understanding your comment, it sounds like there is nothing actionable for us here, as there is nothing we can do about remote debugging and local debugging is covered by #558. Closing -- please reopen if I missed something.

@golang golang locked and limited conversation to collaborators Jan 20, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Projects
None yet
Development

No branches or pull requests

4 participants