0

I have a daemon written in python that runs as root and listens for "command codes" on a memory queue. Each "command code" is mapped (statically) to a real command that the script executes (as root) when the corresponding code arrives through the queue. This is done to ease the task of running things that requires root from non-root processes (like apache), without having to mess with dirty hacks.

Example:

  • command code: dump-db
  • command: mysqldump -u root -p --all-databases > alldb.sql

This works, and as far as I know is safe (meaning that no unprivileged user is able to execute anything outside of the specific pre-defined commands as root). Now I'd like to allow passing one or more parameter along with the command codes:

  • command code: dump-db command params: [first, second]
  • command (template): some_script --some_par --first_par {0} --second_par {1} command (final version with params): some_script --some_par --first_par first --second_par second

Python code will be like:

cmd = template.format(params)
cmd_expl = shlex.split(cmd)
subprocess.check_output(cmd_expl)

I know that there could be serious risks in doing it with Shell=true (see https://stackoverflow.com/a/29023432/1044560). Is it safe with Shell=false? Can that be exploited too?

flagg19
  • 1,782
  • 2
  • 22
  • 27
  • it's safe, but if it calls a custom script, you have to harden the underlying custom script. ";" won't be interpreted as another command for instance, but as a parameter of your script. If your script is not failsafe for this, there could be an issue – Jean-François Fabre Feb 16 '18 at 14:57
  • I suggest not using `shlex.split` and handle everything in a parameter list. – Jean-François Fabre Feb 16 '18 at 14:58

1 Answers1

0

So, as @Jean-FrançoisFabre noticed, the call to subprocess.check_output is safe, but since I'm calling a script, responsability pass to the script. In my case the best way I've found to make sure no weird input is passed to my script was to check it with a very strict regex.

flagg19
  • 1,782
  • 2
  • 22
  • 27