{"action":"created","issue":{"url":"https://api.github.com/repos/outbrain/orchestrator-agent/issues/9","labels_url":"https://api.github.com/repos/outbrain/orchestrator-agent/issues/9/labels{/name}","comments_url":"https://api.github.com/repos/outbrain/orchestrator-agent/issues/9/comments","events_url":"https://api.github.com/repos/outbrain/orchestrator-agent/issues/9/events","html_url":"https://github.com/outbrain/orchestrator-agent/pull/9","id":109391292,"number":9,"title":"Mark commands that need elevated privileges explicitly","user":{"login":"grierj","id":367857,"avatar_url":"https://avatars.githubusercontent.com/u/367857?v=3","gravatar_id":"","url":"https://api.github.com/users/grierj","html_url":"https://github.com/grierj","followers_url":"https://api.github.com/users/grierj/followers","following_url":"https://api.github.com/users/grierj/following{/other_user}","gists_url":"https://api.github.com/users/grierj/gists{/gist_id}","starred_url":"https://api.github.com/users/grierj/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/grierj/subscriptions","organizations_url":"https://api.github.com/users/grierj/orgs","repos_url":"https://api.github.com/users/grierj/repos","events_url":"https://api.github.com/users/grierj/events{/privacy}","received_events_url":"https://api.github.com/users/grierj/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-10-01T21:43:06Z","updated_at":"2015-10-05T19:29:56Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/outbrain/orchestrator-agent/pulls/9","html_url":"https://github.com/outbrain/orchestrator-agent/pull/9","diff_url":"https://github.com/outbrain/orchestrator-agent/pull/9.diff","patch_url":"https://github.com/outbrain/orchestrator-agent/pull/9.patch"},"body":"This is beneficial for whitelisting sudo commands.  The previous setup\r\nrequired sudo to allow \"bash\" which is a privilege escalation.  This way\r\nallows us to whitelist specific commands that need escalation and run\r\nnon-privileged commands without sudo.\r\n\r\nCommands that are configured via the config file don't need to be marked with\r\nsudoCmd since you can specify sudo in the configuration"},"comment":{"url":"https://api.github.com/repos/outbrain/orchestrator-agent/issues/comments/145641642","html_url":"https://github.com/outbrain/orchestrator-agent/pull/9#issuecomment-145641642","issue_url":"https://api.github.com/repos/outbrain/orchestrator-agent/issues/9","id":145641642,"user":{"login":"grierj","id":367857,"avatar_url":"https://avatars.githubusercontent.com/u/367857?v=3","gravatar_id":"","url":"https://api.github.com/users/grierj","html_url":"https://github.com/grierj","followers_url":"https://api.github.com/users/grierj/followers","following_url":"https://api.github.com/users/grierj/following{/other_user}","gists_url":"https://api.github.com/users/grierj/gists{/gist_id}","starred_url":"https://api.github.com/users/grierj/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/grierj/subscriptions","organizations_url":"https://api.github.com/users/grierj/orgs","repos_url":"https://api.github.com/users/grierj/repos","events_url":"https://api.github.com/users/grierj/events{/privacy}","received_events_url":"https://api.github.com/users/grierj/received_events","type":"User","site_admin":false},"created_at":"2015-10-05T19:29:55Z","updated_at":"2015-10-05T19:29:55Z","body":"I did another pass over the functions, looks like MountLV has sudoCmd here:\r\nhttps://github.com/grierj/orchestrator-agent/blob/f7bc815ced528d36a279c82cb71bb2e9a3b3f33b/src/github.com/outbrain/orchestrator-agent/osagent/osagent.go#L240\r\n\r\nIt's a little buried in the function.  Should I break out the sudoCmd modification from being inlined in the commandOutput function?  That might make things less clustered together.\r\n\r\nSo outside of you pointing me at that, I can't find any others that I think would need to run at elevated privilege, sorry if I'm totally missing something.\r\n\r\nI did find that blkid runs without sudo, however a little digging suggest that you want to run it as root when possible:\r\n\"Note that blkid reads information directly from devices and for non-root users it returns cached unverified information.\""}}