diff options
author | Sean Whitton <spwhitton@spwhitton.name> | 2021-03-27 15:42:01 -0700 |
---|---|---|
committer | Sean Whitton <spwhitton@spwhitton.name> | 2021-03-27 15:42:01 -0700 |
commit | 0c47cf7807a064b854d59488007d904089dccbd7 (patch) | |
tree | 679fcbbc3f210bd532f642e84ba923d528634cb9 | |
parent | cfe16b763ba7f643861fef76ad1ed5642c5de264 (diff) | |
download | consfigurator-0c47cf7807a064b854d59488007d904089dccbd7.tar.gz |
:AS connection type uses :SU not :SUDO
Signed-off-by: Sean Whitton <spwhitton@spwhitton.name>
-rw-r--r-- | consfigurator.asd | 1 | ||||
-rw-r--r-- | src/connection/as.lisp | 21 | ||||
-rw-r--r-- | src/connection/su.lisp | 34 | ||||
-rw-r--r-- | src/package.lisp | 5 |
4 files changed, 51 insertions, 10 deletions
diff --git a/consfigurator.asd b/consfigurator.asd index 856cb4e..c65813e 100644 --- a/consfigurator.asd +++ b/consfigurator.asd @@ -38,6 +38,7 @@ (:file "src/connection/fork") (:file "src/connection/ssh") (:file "src/connection/sudo") + (:file "src/connection/su") (:file "src/connection/sbcl") (:file "src/connection/chroot") (:file "src/connection/chroot/fork") diff --git a/src/connection/as.lisp b/src/connection/as.lisp index b5a9f69..6f6edc6 100644 --- a/src/connection/as.lisp +++ b/src/connection/as.lisp @@ -24,13 +24,14 @@ (zerop (foreign-funcall "geteuid" :int))) (defmethod establish-connection ((type (eql :as)) remaining &key to) - "Establish a :SETUID or :SUDO connection to another user account, depending -on whether it is possible to establish a :SETUID connection. - -This connection type does not support sudo with a password -- it is designed -to be used as root." - (if (and (lisp-connection-p) - (can-setuid) - (can-probably-fork)) - (establish-connection :setuid remaining :to to) - (establish-connection :sudo remaining :user to))) + "Establish a :SETUID or :SU connection to another user account, depending on +whether it is possible to establish a :SETUID connection. + +Note that both these connection types require root." + ;; An alternative to :SU would be :SUDO or runuser(1), but :SU is more + ;; portable. + (establish-connection (if (and (lisp-connection-p) + (can-setuid) + (can-probably-fork)) + :setuid :su) + remaining :to to)) diff --git a/src/connection/su.lisp b/src/connection/su.lisp new file mode 100644 index 0000000..444ece2 --- /dev/null +++ b/src/connection/su.lisp @@ -0,0 +1,34 @@ +;;; Consfigurator -- Lisp declarative configuration management system + +;;; Copyright (C) 2021 Sean Whitton <spwhitton@spwhitton.name> + +;;; This file is free software; you can redistribute it and/or modify +;;; it under the terms of the GNU General Public License as published by +;;; the Free Software Foundation; either version 3, or (at your option) +;;; any later version. + +;;; This file is distributed in the hope that it will be useful, +;;; but WITHOUT ANY WARRANTY; without even the implied warranty of +;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +;;; GNU General Public License for more details. + +;;; You should have received a copy of the GNU General Public License +;;; along with this program. If not, see <http://www.gnu.org/licenses/>. + +(in-package :consfigurator.connection.su) +(named-readtables:in-readtable :consfigurator) + +(defmethod establish-connection ((type (eql :su)) remaining &key to) + (declare (ignore remaining)) + ;; We don't support using su with a password. Use :SUDO for that. + (assert-euid-root) + (informat 1 "~&Switching to user ~A" to) + (make-instance 'su-connection :user to)) + +(defclass su-connection (shell-wrap-connection) + ((user :initarg :user))) + +(defmethod connection-shell-wrap ((connection su-connection) cmd) + (format nil "su ~A -c ~A" + (escape-sh-token (slot-value connection 'user)) + (escape-sh-token cmd))) diff --git a/src/package.lisp b/src/package.lisp index 014840b..76d1802 100644 --- a/src/package.lisp +++ b/src/package.lisp @@ -322,6 +322,11 @@ #:alexandria #:consfigurator.connection.shell-wrap)) +(defpackage :consfigurator.connection.su + (:use #:cl + #:consfigurator + #:consfigurator.connection.shell-wrap)) + (defpackage :consfigurator.connection.local (:use #:cl #:consfigurator #:alexandria) (:export #:local-connection)) |