Replace 'sudo' with 'setpriv' for dropping privileges

- sudo and su are meant for adding privileges

- using sudo also floods auth.log with env variables which could contain sensible data like passwords

Author: Lupul

bin/v-add-fs-archive

@@ -52,8 +52,7 @@ for src in $*; do
         src=$(echo "$src"| sed -e "s|/home/$user/||")
 
         # Creating tar.gz archive
-        sudo -u $user -- tar -rf "${archive/.gz/}" -C /home/$user $src >\
-            /dev/null 2>&1
+        setpriv --init-groups --reuid "$user" --regid "$user" -- tar -rf "${archive/.gz/}" -C /home/$user $src >/dev/null 2>&1
         if [ "$?" -ne 0 ]; then
             echo "Error: archive $archive was not created"
             exit 3
@@ -64,7 +63,7 @@ done
 
 # Checking gzip
 if [[ "$archive" =~ \.gz$ ]]; then
-    sudo -u $user -- gzip "${archive/.gz/}" >/dev/null 2>&1
+    setpriv --init-groups --reuid "$user" --regid "$user" -- gzip "${archive/.gz/}" >/dev/null 2>&1
     if [ "$?" -ne 0 ]; then
         echo "Error: archive $archive was not gziped"
         exit 3

bin/v-add-fs-directory

@@ -33,7 +33,7 @@ if [ -z "$(echo $rpath |egrep "^/tmp|^$homedir")" ]; then
 fi
 
 # Adding directory
-sudo -u $user -- mkdir -p "$dst_dir" >/dev/null 2>&1
+setpriv --init-groups --reuid "$user" --regid "$user" -- mkdir -p "$dst_dir" >/dev/null 2>&1
 if [ $? -ne 0 ]; then
     echo "Error: directory $dst_dir was not created"
     exit 3

bin/v-add-fs-file

@@ -33,7 +33,7 @@ if [ -z "$(echo $rpath |egrep "^/tmp|^$homedir")" ]; then
 fi
 
 # Creating file
-sudo -u $user -- touch "$dst_file" >/dev/null 2>&1
+setpriv --init-groups --reuid "$user" --regid "$user" -- touch "$dst_file" >/dev/null 2>&1
 if [ $? -ne 0 ]; then 
     echo "Error: file $dst_file was not created"
     exit 3

bin/v-add-web-domain

@@ -83,7 +83,7 @@ ln -f -s /var/log/$WEB_SYSTEM/domains/$domain.*log \
     $HOMEDIR/$user/web/$domain/logs/
 
 # Adding domain skeleton
-sudo -u $user -- cp -r $WEBTPL/skel/* "$HOMEDIR/$user/web/$domain/" >/dev/null 2>&1
+setpriv --init-groups --reuid "$user" --regid "$user" -- cp -r $WEBTPL/skel/* "$HOMEDIR/$user/web/$domain/" >/dev/null 2>&1
 for file in $(find "$HOMEDIR/$user/web/$domain/" -type f); do
     sed -i "s/%domain%/$domain/g" $file
 done

bin/v-change-fs-file-permission

@@ -40,7 +40,7 @@ if [ -z "$(echo $rpath |egrep "^/tmp|^$homedir")" ]; then
 fi
 
 # Changing file permissions
-sudo -u $user -- chmod -R $permissions "$src_file" >/dev/null 2>&1
+setpriv --init-groups --reuid "$user" --regid "$user" -- chmod -R $permissions "$src_file" >/dev/null 2>&1
 if [ $? -ne 0 ]; then
     echo "Error: access permission on $src_file was not changed"
     exit 3

bin/v-check-fs-permission

@@ -35,7 +35,7 @@ if [ ! -z "$src" ]; then
 fi
 
 # Checking if file has readable permission
-sudo -u $user -- ls "$src" > /dev/null 2>&1
+setpriv --init-groups --reuid "$user" --regid "$user" -- ls "$src" > /dev/null 2>&1
 if [ $? -ne 0 ]; then
     echo "Error: can't read $src"
     exit 1

bin/v-copy-fs-directory

@@ -47,7 +47,7 @@ if [ -z "$(echo $rpath |egrep "^/tmp|^$homedir")" ]; then
 fi
 
 # Copying directory
-sudo -u $user -- cp -rf "$src_dir" "$dst_dir" >/dev/null 2>&1
+setpriv --init-groups --reuid "$user" --regid "$user" -- cp -rf "$src_dir" "$dst_dir" >/dev/null 2>&1
 if [ $? -ne 0 ]; then
     echo "Error: directory $src_dir was not copied"
     exit 3

bin/v-copy-fs-file

@@ -47,7 +47,7 @@ if [ -z "$(echo $rpath |egrep "^/tmp|^$homedir")" ]; then
 fi
 
 # Copying file
-sudo -u $user -- cp "$src_file" "$dst_file" >/dev/null 2>&1
+setpriv --init-groups --reuid "$user" --regid "$user" -- cp "$src_file" "$dst_file" >/dev/null 2>&1
 if [ $? -ne 0 ]; then
     echo "Error: file $src_file was not copied"
     exit 3

bin/v-delete-fs-directory

@@ -34,7 +34,7 @@ if [ -z "$(echo $rpath |egrep "^/tmp|^$homedir")" ]; then
 fi
 
 # Deleting directory
-sudo -u $user -- rm -rf "$dst_dir" # >/dev/null 2>&1
+setpriv --init-groups --reuid "$user" --regid "$user" -- rm -rf "$dst_dir" # >/dev/null 2>&1
 if [ $? -ne 0 ]; then
     echo "Error: directory $dst_dir was not deleted"
     exit 3

bin/v-delete-fs-file

@@ -34,7 +34,7 @@ if [ -z "$(echo $rpath |egrep "^/tmp|^$homedir")" ]; then
 fi
 
 # Deleting file
-sudo -u $user -- rm -f "$dst_file" >/dev/null 2>&1
+setpriv --init-groups --reuid "$user" --regid "$user" -- rm -f "$dst_file" >/dev/null 2>&1
 if [ $? -ne 0 ]; then
     echo "Error: file $dst_file was not deleted"
     exit 3