0ae1694830
The wildcard granted passwordless root for timedatectl set-timezone plus any trailing arguments, so -H/--host and -M/--machine reached the SSH and machine transports as root. Systemd 261 guards argv injection into ssh, but -H still drives root's SSH client at an attacker-chosen host, and the transport resolves its helper through PATH; only Defaults secure_path stands between that and a planted ssh running as root. Match the argument with an anchored POSIX ERE that admits exactly one timezone token (no whitespace, no leading-dash segment, no traversal component), so no second argument and no option can ever match. The sole caller, omarchy-menu-timezone, passes one list-timezones value and is unaffected. Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> Co-authored-by: Codex XHigh <noreply@openai.com>
41 lines
1.8 KiB
Bash
41 lines
1.8 KiB
Bash
#!/bin/bash
|
|
|
|
set -euo pipefail
|
|
|
|
source "$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)/base-test.sh"
|
|
|
|
timezone_menu="$ROOT/bin/omarchy-menu-timezone"
|
|
sudoers_file="$ROOT/etc/sudoers.d/omarchy-tzupdate"
|
|
|
|
grep -F '%wheel ALL=(root) NOPASSWD: /usr/bin/timedatectl ^set-timezone [A-Za-z0-9_+][A-Za-z0-9_+.-]*(/[A-Za-z0-9_+][A-Za-z0-9_+.-]*)*$' "$sudoers_file" >/dev/null ||
|
|
fail "timezone sudoers rule allows passwordless timedatectl timezone changes"
|
|
|
|
! grep -F 'set-timezone *' "$sudoers_file" >/dev/null ||
|
|
fail "timezone sudoers rule uses a bare wildcard that admits extra arguments like -H and -M"
|
|
|
|
! grep -F 'tzupdate' "$sudoers_file" >/dev/null ||
|
|
fail "timezone sudoers rule does not grant passwordless tzupdate"
|
|
|
|
grep -F 'sudo timedatectl set-timezone "$timezone"' "$timezone_menu" >/dev/null ||
|
|
fail "timezone menu uses the passwordless sudoers timedatectl rule"
|
|
|
|
! grep -F 'pkexec timedatectl set-timezone "$timezone"' "$timezone_menu" >/dev/null ||
|
|
fail "timezone menu does not wrap timedatectl in pkexec"
|
|
|
|
! grep -F 'pkexec /usr/bin/timedatectl set-timezone "$timezone"' "$timezone_menu" >/dev/null ||
|
|
fail "timezone menu does not wrap timedatectl in pkexec"
|
|
|
|
! grep -F 'sudo /usr/bin/timedatectl set-timezone "$timezone"' "$timezone_menu" >/dev/null ||
|
|
fail "timezone menu lets sudo resolve timedatectl from its secure path"
|
|
|
|
! grep -Fx 'timedatectl set-timezone "$timezone"' "$timezone_menu" >/dev/null ||
|
|
fail "timezone menu does not use bare timedatectl, which triggers polkit"
|
|
|
|
grep -F 'omarchy-shell -q omarchy.clock refresh' "$timezone_menu" >/dev/null ||
|
|
fail "timezone menu refreshes the namespaced clock IPC target"
|
|
|
|
! grep -F 'omarchy-shell -q Clock refresh' "$timezone_menu" >/dev/null ||
|
|
fail "timezone menu no longer refreshes the retired Clock IPC target"
|
|
|
|
pass "timezone menu refreshes clock after timezone changes"
|