secured environment for output generation

[skhuang]

你們在產生 output 或進行 fault localization 時，有 security 的問題要注意。因為程式可以寫
system("rm -rf *");
這樣你們的資料就會被殺光。你們可能要先過濾程式是否有 system, unlink 等 function call.
後續，我再教你們如何處理這類型的問題。

[skhuang]

你們在執行外部命名時，原本是以 www-data 執行 cmd arg ....
現在改為
/usr/bin/sudo /bin/su penobody -c cmd arg ...

這樣就以 penobody 的權限執行，就無法動到 www-data 的檔案。

[skhuang]

另外有關 security ，另外解法是 linux control group, 用 cgexec. 我們後續可慢慢學。

[lancechentw]

you may also consider using

/usr/bin/sudo -u penobody cmd args

[skhuang]

it is restricted in /etc/sudoers with NOPASSWD for /bin/su penobody -c. Is it possible to limit sudo -u penobody without password ? the command launched by www-data is from web applications.

[lancechentw]

Sure, a simple example

www-data    ALL = (penobody) NOPASSWD: /usr/bin/cmdA, /usr/bin/cmdB, /usr/bin/cmdC

User www-data can run cmdA, cmdB and cmdC as user penobody without authentication on any hosts.

[skhuang]

It is a better solution. We need the whitelist of cmdA,B,C. Another concern is that the command executed may create a backdoor to other sites. (I just restrict outgoing connection)