当给予“sudo”访问权限时“apt-get install”的安全性如何（通过“sudoers”文件）
如果我的 Linux 计算机 (Ubuntu 11.10) 上有十几个用户，那么为每个人提供 sudo 访问 apt-get install 的安全问题是什么。
我希望我的用户能够安装和使用程序，而不必每次都向我发送电子邮件。但是，apt-get 命令会导致问题吗？如果是的话，能否提供一些例子。
If I have a dozen users on my linux machine (Ubuntu 11.10), what are the security concerns of giving each of them sudo access of apt-get install.
I want my users to be able to install and use programs without having to send me an e-mail every time. However, can apt-get commands ever lead to problems? If so, can some examples be provided.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
这在很大程度上取决于用户可用的软件存储库。
如果您允许用户将自己的存储库添加到
/etc/apt/sources.list或/etc/apt/sources.list.d/*，那么您'我们给了他们一个不受限制的 root 帐户。如果你坚持使用默认的 Ubuntu 存储库和默认的 Ubuntu 软件包，那么你是相当安全的——至少，我不知道有任何软件包会安装明显不安全的 setuid 程序或明显不安全的守护进程，而且我会希望 Ubuntu 安全团队认真对待任何此类错误。
更新
Ubuntu 提供几种不同类型的存储库：
< code>main 和
restricted得到了 Ubuntu 安全团队的良好支持和严格审查。universe和multiverse不包含在 CD/DVD 中，而是由 Ubuntu 安全团队以尽力的方式提供支持（根据我的经验，这相当不错）很好，但他们不会为其中任何一个提供长期支持）。partner中的所有内容均直接从软件供应商传递，没有 Ubuntu 安全团队的任何监督工作（尽管他们严重依赖不安全产品的供应商）。因为供应商希望保持轻松可用（并且总体上是诚实的），所以他们不会故意做一些愚蠢的事情来损害您的系统安全。由于设置自己的存储库很容易，因此确保不受信任的用户无法添加自己的存储库非常重要到
apt。It depends in large part on the software repositories that are available to your users.
If you allow your users to add their own repositories to
/etc/apt/sources.listor/etc/apt/sources.list.d/*, then you've given them an unrestricted root account.If you stick with default Ubuntu repositories with default Ubuntu packages, you're reasonably safe -- at least, I don't know any packages off the top of my head that install blatantly unsafe setuid programs or blatantly unsafe daemons, and I'd expect the Ubuntu security team to take any such bugs seriously.
Update
Ubuntu provides several different kinds of repositories:
Everything in
mainandrestrictedis very-well supported and well-vetted by the Ubuntu security team.universeandmultiversearen't included on the CDs/DVDs, are supported by the Ubuntu security team in a best-effort sort of way (which in my experience has been quite good, but they aren't about to provide long-term support for any of it).Everything in
partneris passed along straight from software vendors without any oversight efforts by Ubuntu security team (though they make lean heavily on vendors of insecure products). Because the vendors want to stay easily available (and on the whole are honest) they won't intentionally do something stupid to compromise your system security.Since it is easy to set up your own repository, it's important to ensure that untrusted users cannot add their own repositories to
apt.如果您的意思是“用户现在可以以 root 身份运行他们喜欢的任何东西吗”，那么答案是是——所以这是不安全。
您可以通过多种方式从 dpkg 或 rpm 运行 shell。例如：当配置文件更改发生冲突时，
dpkg将提示，选项之一是启动 shell 来检查情况。 如果通过sudo运行apt-get，这将以 root 身份启动 shell。同样，如果您可以从该工具运行编辑器，因为大多数编辑器允许您从其中运行任意 shell 命令（例如
vi中的!command）。If you mean "can the user now run anything they like as root" then the answer is YES -- so this is not safe.
There are ways that you can run a shell from
dpkgorrpm. For example:dpkgwill prompt when there is a config file change which clashes, with one of the options being start a shell to examine the situation. This will start a shell as root ifapt-getwas run viasudo.Likewise, if you can run an editor from the tool, as most editors let you run arbitrary shell commands from within them (e.g.
!commandinvi).apt-get 通常是完全无害的。它只能安装和下载文件。
可能发生的最糟糕的事情是有人不小心安装了恶意软件。
apt-get is usually completely harmless. It is only capable of installing and downloading files.
The worst thing that could happen is that someone would accidentally install a malicious piece of software.