Georg/authorized-exec
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Anchoring

Browse Source 
For better security out of the box, always perform exact matching unless
a more lenient pattern is explicitly provided by the administrator.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
This commit is contained in:
Georg Pfuetzenreuter 2024-09-15 18:33:52 +02:00
parent 67f5059b36
commit 3bed7bad11
Signed by: Georg
GPG Key ID: 1ED2F138E7E6FF57
3 changed files with 7 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
authorized-exec.pl
View File

@ -40,7 +40,7 @@ if ($ssh_cmd) {
exit 1 exit 1
} }
my %cmds = map { qr{$_} => 1 } @{$config{$user}}; my %cmds = map { qr/^$_$/ => 1 } @{$config{$user}};
if ( any { $cmd =~ $_ } keys %cmds ) { if ( any { $cmd =~ $_ } keys %cmds ) {
exec $cmd; exec $cmd;

2
authorized-exec.spec
View File

@ -18,7 +18,7 @@
Name: authorized-exec Name: authorized-exec
Version: 1.0 Version: 1.1
Release: 0 Release: 0
Summary: Health check Summary: Health check
License: EUPL-1.2 License: EUPL-1.2

9
config.example.pl
View File

@ -1,10 +1,11 @@
# the patterns are read as regular expressions and anchored with ^ and $ by default
( (
'georg' => [ 'georg' => [
'^echo hi$', 'echo hi',
'^true$', 'true',
'^printf %s [a-z0-9 ]+$', 'printf %s [a-z0-9 ]+',
], ],
'root' => [ 'root' => [
'^ls -a /root$', 'ls -a /root',
], ],
) )