Only run "untrusted" programs under sudo

[gruntmaster-daemon.git] / gruntmaster-exec

diff --git a/gruntmaster-exec b/gruntmaster-exec
index c824b20a76af263223e07db9640b91d9e2dda5fa..25a44d16f48f8635b58868a9f2c9695dab7caf45 100755 (executable)
--- a/gruntmaster-exec
+++ b/gruntmaster-exec
@@ -45,7 +45,7 @@ GetOptions(
 
 my $killuser = $ENV{GRUNTMASTER_KILL_USER};
 my @sudo;
-@sudo = (shellwords ($ENV{GRUNTMASTER_SUDO}), '--') if $ENV{GRUNTMASTER_SUDO};
+@sudo = (shellwords ($ENV{GRUNTMASTER_SUDO}), '--') if $ENV{GRUNTMASTER_SUDO} && $nobody;
 $mlimit = 1_000_000_000 if @sudo; # sudo wants a lot of address space
 
 my $ret = fork // die 'Cannot fork';
@@ -94,7 +94,8 @@ if ($ret) {
        setrlimit RLIMIT_NPROC, $nproc, $nproc or die $! if $nobody;
        POSIX::setgid $nobody ? 65534 : USER;
        POSIX::setuid $nobody ? 65534 : GROUP;
-       unshift @ARGV, @sudo if $nobody;
+       unshift @ARGV, @sudo;
+       say STDERR "Execing: ", join ' ', map { "'$_'" } @ARGV;
        exec @ARGV;
 }