#1011509 debci: improve security of sudoers file

Package:
debci
Source:
debci
Submitter:
Julian Gilbey
Date:
2022-05-24 07:18:04 UTC
Severity:
normal
#1011509#5
Date:
2022-05-24 07:14:07 UTC
From:
To:
The sudoers file included in this package (/etc/sudoers.d/debci)
allows the debci group to run /usr/bin/timeout without any password or
restrictions; this effectively gives anyone in the debci group
unrestricted access to root.

I would recommend replacing:
%debci ALL = NOPASSWD:SETENV: /usr/bin/lxc-*, /usr/bin/timeout
by the following:
%debci ALL = NOPASSWD:SETENV: /usr/bin/lxc-*, /usr/bin/timeout ^[0-9]+ lxc-.*$
so that timeout can only be used to run lxc-* commands; this is all
that is needed in autopkgtest-virt-lxc.

Best wishes,

   Julian