lars wrote:
Hi, I want to package a perl web-interface that needs root permissions for some operations. As the perl-suid package is marked as deprecated, I am not sure, how to do this in the good debian way ... Maybe you could give me some hints.
As I recall, the whole idea of perl-suid was abandoned upstream. It was found that it's not possible to do it securely.
The perl-cgi should be able to execute the following actions: - use cryptsetup for partitions - mount/umount _arbitrary_ mapped devices - partition harddisks For now I see the following options: - write a short binary wrapper with suid permissions - move all routines, that need root permission to a seperate script and add an entry to /etc/sudoers for it It does not seem to be sufficient, to just set the right permissions on selected block devices, as only root may mount something without an entry to fstab. Do you have any suggestions?
You could also add entries to sudoers for all the commands the script needs to run. Then in your CGI script, instead of just running the external program directly (mount, cfdisk, whatever), you'd call sudo to run it. I think this would probably be the most secure method. If you were to make another script and run *it* through sudo, then you have to be *darn sure* that script is solid. But by running each command through sudo, you can define exactly what options and what devices are allowed--if you can narrow it down.
Allowing a web script to partition your hard disks sounds pretty scary... But these days it seems there's a web script for everything! :-)
ttyl -- C. Chad Wallace, B.Sc. The Lodging Company http://skihills.com/ OpenPGP Public Key ID: 0x262208A0