I have a script, which I need to execute with sudo.
#!/bin/bash
cp "$@" /destionation/dir
Is it a good script or someone can bypass the restriction destination dir ?
Thanks for suggestions.
Well, there's a small typo: /destionation
instead of /destination
.
There are security issues with this script.
A user could pass `sudo /bin/bash`
as the filename, and then they would have a root shell.
They can also nest commands, such as:
`sudo /bin/bash; echo "hello" >> /tmp/from_root`
To form any set of operations that run as the root user.
I'd recommend against using this script because not only does the destination directory not matter, but you have bigger issues.
A possibly better solution is to create a directory that is world-writable so that you don't need the sudo permissions.
echo "$@"
, but ./script '`echo $0`'
returns _`echo $0`
(without the underscore). Same with ./script \`echo \$0\`
. Does bash automatically escape the arguments it passes to scripts?