42 lines
1.3 KiB
Markdown
42 lines
1.3 KiB
Markdown
|
# 审计 — rsync 推送 sudo 提权 + 批量 sudoers 补丁
|
||
|
|
|
||
|
|
## 范围（文件清单）
|
||
|
|
|
||
|
|
| 文件 | 变更 |
|
||
|
|
|------|------|
|
||
|
|
| `server/utils/rsync_elevation.py` | 非 root 默认 sudo rsync |
|
||
|
|
| `server/application/services/sync_engine_v2.py` | `_rsync_push` 接入 |
|
||
|
|
| `server/application/services/files_sudoers_service.py` | sudoers 模板与安装 |
|
||
|
|
| `server/api/sync_v2.py` | 诊断写入 sudo 回退 |
|
||
|
|
| `server/api/servers.py` | setup-files-sudo 复用 service |
|
||
|
|
| `scripts/batch_patch_files_sudoers.py` | 批量补丁脚本 |
|
||
|
|
|
||
|
|
## Step 3 规则扫描
|
||
|
|
|
||
|
|
| H | 规则 | 结论 |
|
||
|
|
|---|------|------|
|
||
|
|
| H1 | sudoers 无用户注入 | PASS — `build_nexus_files_sudoers` 固定白名单 |
|
||
|
|
| H2 | rsync-path 无外部输入 | PASS — 常量 `sudo -n rsync` |
|
||
|
|
| H3 | 密码不经 argv | PASS — stdin `sudo -S` |
|
||
|
|
|
||
|
|
## Closure
|
||
|
|
|
||
|
|
| H | 判定 | 依据 |
|
||
|
|
|---|------|------|
|
||
|
|
| H1 | PASS | files_sudoers_service |
|
||
|
|
| H2 | PASS | rsync_elevation.py |
|
||
|
|
| H3 | PASS | _write_sudoers_with_password |
|
||
|
|
|
||
|
|
## DoD
|
||
|
|
|
||
|
|
- [x] pytest test_rsync_elevation + test_nexus_files_sudoers
|
||
|
|
- [x] changelog 2026-06-11-rsync-push-sudo-elevation.md
|
||
|
|
- [x] 批量脚本 batch_patch_files_sudoers.sh
|
||
|
|
|
||
|
|
## 验证
|
||
|
|
|
||
|
|
```bash
|
||
|
|
pytest tests/test_rsync_elevation.py tests/test_nexus_files_sudoers.py -q
|
||
|
|
bash scripts/batch_patch_files_sudoers.sh --name 温胜夜 --dry-run
|
||
|
|
```
|