sudo_approve

#!/usr/bin/env bash
#
# Copyright 2018 Square Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#    http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
# implied. See the License for the specific language governing
# permissions and limitations under the License.

set -o errexit  # quit on first error
set -o pipefail # quit on failures in pipes
set -o nounset  # quit on unset variables

[[ ${TRACE:-} ]] && set -o xtrace # output subcommands if TRACE is set

declare -r SUDO_SOCKET_PATH="/var/run/sudo_pair"

pair() {
    declare -r socket="${1}"

    # restore TTY settings on exit
    # shellcheck disable=SC2064
    trap "stty $(stty -g)" EXIT

    # disable line-buffering and local echo, so the pairer doesn't
    # get confused that their typing in the shell isn't doing
    # anything
    stty cbreak -echo

    # send SIGINT on Ctrl-D
    stty intr "^D"

    clear

    # prompt the user to approve
    socat STDIO unix-connect:"${socket}"
}

usage() {
    echo "Usage: $(basename -- "$0") uid pid"
    exit 1
}

main() {
    declare -r socket_path="${1}"
    declare -ri uid="${2}"
    declare -ri pid="${3}"

    # if we're running this under `sudo`, we want to know the original
    # user's `uid` from `SUDO_UID`; if not, it's jsut their normal `uid`
    declare -i ruid
    ruid="${SUDO_UID:-$(id -u)}"
    declare -r ruid

    declare -r socket="${socket_path}/${uid}.${pid}.sock"

    declare -i socket_uid socket_gid
    socket_uid="$(stat -c '%u' "${socket}")"
    socket_gid="$(stat -c '%g' "${socket}")"
    declare -r socket_uid socket_gid

    declare socket_user socket_group socket_mode
    socket_user="$(getent passwd "${socket_uid}" | cut -d: -f1)"
    socket_group="$(getent group "${socket_gid}" | cut -d: -f1)"
    socket_mode="$(stat -c '%a' "${socket}")"
    declare -r socket_user socket_group socket_mode

    # if the user approving the command is the same as the user who
    # invoked `sudo` in the first place, abort
    #
    # another option would be to allow the session, but log it in a way
    # that it immediately pages oncall security engineers; such an
    # approach is useful in production systems in that it allows for a
    # in-case-of-fire-break-glass workaround so engineers can respond to
    # a outage in the middle of the night
    #
    # this responsibility will be moved into the plugin itself when time
    # allots
    if [[ "${uid}" -eq "${ruid}" ]]; then
        echo "Users may not approve their own sudo session"
        exit 1
    fi

    # if we can write:          pair
    # if user-owner can write:  sudo to them and try again
    # if group-owner can write: sudo to them and try again
    # if none, die
    if [ -w "${socket}" ]; then
        pair "${socket}"
    elif [[ $(( 8#${socket_mode} & 8#200 )) -ne 0 ]]; then
        sudo -u "${socket_user}" "${0}" "${uid}" "${pid}"
    elif [[ $(( 8#${socket_mode} & 8#020 )) -ne 0 ]]; then
        sudo -g "${socket_group}" "${0}" "${uid}" "${pid}"
    else
        echo "The socket for this sudo session is neither user- nor group-writable."
        exit 2
    fi
}

case "$#" in
    2) main "${SUDO_SOCKET_PATH}" "$1" "$2" ;;
    *) usage ;;
esac