From: Ken Bloom <kbloom@...>
Date: 2007-06-13T23:40:06+09:00
Subject: Re: executing sudo from ruby

On Wed, 13 Jun 2007 22:19:16 +0900, Alex Young wrote:

> anansi wrote:
>> the thing is that everything needs to be done by this script and no
>> further command. So can an app give it self the root uid at runtime?
> After a little experimentation (on Ubuntu), it would seem that the only
> way to get my suggestion to work is by creating a setuid link to the
> ruby binary, and using that to run the script.  That's just as insecure
> as keeping a password in a file, so I take back my suggestion entirely.
> 
> A slightly less unsafe method (but still rather iffy) would be to create
> a public key for the root account, and do everything over SSH.  That way
> you can arrange to only need to authenticate once per session (or, if
> you really want to play fast and loose, leave the private key with an
> empty passphrase).  I don't know if that helps at all...

To run your editor, you'd probably need to use the -t option of ssh to 
alloate a pseudo-tty.

You can configure the SSH keypair so that it's only authorized to run a 
couple of specific commands, which should help with security. Also, be 
sure to use "nano -R" so that the user can't edit other files.

The exec() call is wrong, because that replaces the running ruby script 
with a different process, and the ruby script can't terminate. system() 
is correct for the second case too.

-- 
Ken Bloom. PhD candidate. Linguistic Cognition Laboratory.
Department of Computer Science. Illinois Institute of Technology.
http://www.iit.edu/~kbloom1/