Well, I've done a lot of reading and documentation around possible exploitation of sudoers files and SUID programs, but don't have a deep enough knowledge to pick up the wisest possible solution for my problem.
We're currently developping a Qt-based tool on Ubuntu for upgrade/rollback management of our main application.
So as you might have guessed, the said tool is making extensive use of apt install
/purge
and dpkg
commands, that happen to be executable only with root privileges, which the tool does not have, as it is meant to be executed only within the limited-privileges user's context.
To circumvent this limitation, the team has chosen the most straightforward solution : adding appropriate entries in the user's sudoers file for the aforementioned commands.
BUT, as far as I know, this opens up a dangerous vulnerability in the system, as an attacker who would gain only limited access to the machine might then remove important components of the underlying linux system (systemd
for instance), thus making the system crash.
As I'm the only cybersecurity engineer in the team, I'm trying to find the safest and most recommended way to mitigate this flaw, but so far could think of only one alternative : turning the upgrade tool into a SUID program.
The thing is : SUID programs have a nefarious reputation when it comes to privilege escalation vulnerabilities they might expose on the target system (see here for a checklist of all the considerations to implement in order not to mess up everything when writing a SUID program).
The question is : is going through this painful process really worth it ?
Is there any other way we could safely use apt
/dpkg
commands without all the hassle of SUID implementation, and without making the upgrade tool run with superuser mode ?
Note: a lot of questions on stackexchange cover SUID related concerns, but none actually discusses the specific usecase we're dealing with.