I've got a Perl test script, initiated with prove, that tests a backup script that requires root privileges so rsync can change the permissions on the files it downloaded from a remote server.
So I've got the following in my Mac's sudoers file:
root ALL=(ALL) ALL
%admin ALL=(ALL) ALL
%admin ALL=(ALL) NOPASSWD:/path/to/prove
It works. But my question is, since prove can be used to run pretty much any perl script written by the local user, is this a huge security risk?
Yes, that approach is insecure.
Write a specific wrapper that specifically runs your command which subsequently calls the prove, secure it so that only root can modify it, and put it somewhere only root can reach. Then, add that wrapper to the sudoers file.
Don't allow parameters in your script.
NB: Although, even that's open to abuse, if someone can modify either the first perl script, or the backup script. Have to ensure everything in the chain is modifiable only by root.
