Retour
-
Titre
Unable to find authorized command rule that works -
Description
An application needs to be able to run some commands with root access. Some of the commands lines are somewhat complicated such as:
"sh -c sh /tmp/installer/GetOSVersion.sh; EC=$?; rm -rf /tmp/installer; exit $EC"
After adding these commands to the allowed commands list in the MCU (pf_authcmds) the commands are not being allowed to run.
-
Cause
The spaces in the command lines are causing problems with the way commands are parsed by Privilege Manager. -
Résolution
The issue can be worked around by replacing each space character in the string passed to the first command with the single character wildcard ('?'). For example the above command could be added to the policy as:
"sh -c sh?/tmp/installer/GetOSVersion.sh;?EC=*;?rm?-rf?/tmp/installer;?exit*",By using the wildcard character instead of a space this allows Privilege Manager to parse the command correctly and still match it to the original command.