Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Run brew commands as regular user #1564

Draft
wants to merge 3 commits into
base: master
Choose a base branch
from
Draft

Run brew commands as regular user #1564

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
9a86c00
Run `brew` as regular user in place of root
Neved4 Oct 21, 2024
ae64484
Refactor `RunBrewCmd()` into a generalised `RunCmdAsUser()`
Neved4 Oct 25, 2024
181f59c
Add `Notes` section to `RunCmdAsUser()` comments
Neved4 Oct 25, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
39 changes: 39 additions & 0 deletions include/functions
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -91,6 +91,7 @@
# ReportManual Log manual actions to report file
# ReportSuggestion Add a suggestion to report file
# ReportWarning Add a warning and priority to report file
# RunCmdAsUser Run commands as a normal user instead of root
# SafeFile Security tests to perform on a file before using it
# SafePerms Check if a file has safe permissions
# SafeInput Test provided string to see if it contains unwanted characters
Expand Down Expand Up @@ -3036,6 +3037,44 @@
}


################################################################################
# Name : RunCmdAsUser()
# Description : Run commands as a normal user instead of root
#
# Parameters : $@ = command arguments
# Returns : None (executes the command as the appropriate user)
# Notes : This allows dropping permissions for specific commands when
# lynis is invoked as root, preventing privilege escalation
# risks (CWE-250, CWE-271).
#
# By isolating privileged code and dropping said privileges as
# soon as possible, we can execute tools with their proper
# permissions, such as in the case of Homebrew.
#
# When available, we use `sudo` and `su`. For a strictly
# POSIX-compliant environment, a C implementation could be
# made using `setgid()` and `setuid()`.
################################################################################
################################################################################

RunCmdAsUser() {
case "$(id -u)" in
0)
if command -v sudo >/dev/null
then
sudo -u "$SUDO_USER" "$@"
elif command -v su >/dev/null
then
su "$(id -un)" -c "$@"
else
"$@"
fi
;;
*) "$@"
esac
}


################################################################################
# Name : SafeInput()
# Description : Test provided string to see if it contains unwanted characters
Expand Down
4 changes: 2 additions & 2 deletions include/tests_ports_packages
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -127,7 +127,7 @@
LogText "Test: Querying brew to get package list"
Display --indent 4 --text "- Querying brew for installed packages"
LogText "Output:"; LogText "-----"
GPACKAGES=$(brew list --versions)
GPACKAGES=$(RunCmdAsUser brew list --versions)
while IFS= read -r PKG; do
PACKAGE_NAME=$(echo ${PKG} | ${CUTBINARY} -d ' ' -f1)
PACKAGE_VERSION=$(echo ${PKG} | ${CUTBINARY} -d ' ' -f2)
Expand Down Expand Up @@ -183,7 +183,7 @@ EOF
PACKAGE_VERSION=$(defaults read "$CS/Contents/Info" CFBundleShortVersionString 2>/dev/null || echo "N/A")
LogText "Found CoreServices: ${PACKAGE_NAME} (version: ${PACKAGE_VERSION})"
INSTALLED_PACKAGES="${INSTALLED_PACKAGES}|${PACKAGE_NAME},${PACKAGE_VERSION}"
done
done
fi
#
#################################################################################
Expand Down