CLI in a Coder built pod and permissions

This is a fairly noob Linux question (despite me working with Linux more intensively for over a year now) and only semi-related to Coder and I decided to ask the question before experimenting, so sorry for me not putting in the work in advance....

But, would it be possible to offer a CLI accessed via the SSH shell Coder offers in the agent pod, yet also deny access to the lower level commands the CLI might use itself? For instance, lets say I create a CLI command

my-cli commit

my-cli commit

my-cli commit

my-cli commit and it in effect calls Git's commit command internally. The

my-cli commit

my-cli commit

my-cli commit

my-cli commitcommand should work, but when the user calls

git commit

git commit

git commit

git commit, she'll get a no command available error. She won't be able to do anything with Git.

My first thought is this won't be possible. I just want to get confirmation from someone more experienced, before I tried to make it happen (only to find out it won't work).

Codercord•6/1/23, 5:25 AM

<#1113699895669432340>

**Category**

Other

**Product**

Coder OSS (v2)

**Platform**

Linux

Logs

Please post any relevant logs/error messages.

ScottOP•6/1/23, 5:29 AM

The overarching contemplation in all this is to still be able to give devs a CLI to work with, just not have them be able to do unwanted things inside the pod. The devs will be third party to the k8s cluster they are in and are untrustworthy.

MrPeacock•6/1/23, 5:54 AM

I would say if they are untrusty do not let them in! You can not make any environment safe. Use another isolated cluster with no network connection to your internal network. This is in my opinion the only way to protect your data.

Just my 2 cents

ScottOP•6/1/23, 6:48 AM

@MrPeacock

Thanks for your reply and generally, you are right. However, offering "in place" or remote development environments in a platform has a lot of compromises and one of them is "letting them in" in order to offer local to the app service connectivity. Or, to put it another way, to offer a 100% exactly as production dev environment.

nother example of a compromise is needing to lint code for underlying "bad code", i.e. doing things outside of the given APIs. For instance, we'll have APIs available to access files, however, if the programmer uses, for example, execexec or fsfs (in Node), the system will fail on them during the automated testing, which they will also not be able to avoid.

I've had discussions with other devs and they just love their CLIs. (why I don't know, cause I dislike them). And, we are just trying to see if we can make this specialized dev environment as cozy as possible.

Suchi•6/1/23, 8:42 AM

What you want to do is called a ssh jail. It's usually done with chroot but i'm not sure that sshd config apply to ssh shell offered by coder. In kube context you can try to play with binary access right and especially setuid for your cli binary (it has to be a binary as setuid does not work on script) in your image definition.

Be extra careful with command you allow, side effects can be easily missed (an exemple in fine grained sudo right context its to allow users to sudo cp in order to copy files owned by other users, they will be able to override any file on the system as you basically give them a way to write file as root and so escalate privilege by overriding /etc/sudoers or /etc/password)

Suchi•6/1/23, 8:53 AM

For your git exemple, your target is

$ ls -l /usr/bin
-rwsr-xr-x privilegied privilegied mycli
-rwxr-x--- privilegied privilegied git

$ ls -l /usr/bin
-rwsr-xr-x privilegied privilegied mycli
-rwxr-x--- privilegied privilegied git

Suchi•6/1/23, 8:55 AM

and start coder-agent with unprivilegiedunprivilegied user

ScottOP•6/2/23, 3:59 AM

@Suchi

Thanks for the response. Do you by chance have some terms I can search for to learn about this? Or maybe even an article or video that shows the basics behind what you are suggesting?

Suchi•6/2/23, 9:35 AM

You can read about setuidsetuid https://en.wikipedia.org/wiki/Setuid or a practical example https://dustinspecker.com/posts/setuid-elevating-privileges/

ScottOP•6/2/23, 12:45 PM

Hmm... it says it only works for binaries. Buggers.... "mycli" is a Node script.

CLI in a Coder built pod and permissions

Similar Threads

Similar Threads

Similar Threads