Opa: Allow users to run only specific binaries with root permissions/privileges

[elbns]

Hello OPA,

Is there a way to allow users (through OPA) to run only specific binaries with root permissions/privileges ?
For exemple in the same way as pam_authz manage sudoers and ssh ?

Regards,

[tsandall]

@elbns that's a good question. I'm not a PAM expert but maybe @arcurtis has some insight here. The existing tutorial shows how you can restrict sudo access but it's somewhat coarse-grained: https://www.openpolicyagent.org/docs/ssh-and-sudo-authorization.html. I don't think the current pam_authz plugin provides the executing command as input.

[arcurtis]

Hi @elbns, as @tsandall noted, you could use the PAM module to broadly restrict access to sudo to specific users. However, as far as I am aware, it is not possible to get the command invoked after sudo in a PAM module (though would love to know if this is, in fact, possible), so finer-grain control with the PAM module isn't possible without that.