{"action":"opened","issue":{"url":"https://api.github.com/repos/letsencrypt/letsencrypt/issues/2399","repository_url":"https://api.github.com/repos/letsencrypt/letsencrypt","labels_url":"https://api.github.com/repos/letsencrypt/letsencrypt/issues/2399/labels{/name}","comments_url":"https://api.github.com/repos/letsencrypt/letsencrypt/issues/2399/comments","events_url":"https://api.github.com/repos/letsencrypt/letsencrypt/issues/2399/events","html_url":"https://github.com/letsencrypt/letsencrypt/issues/2399","id":132147040,"number":2399,"title":"Calling sudo from inside a script = bad","user":{"login":"x0x7","id":16278428,"avatar_url":"https://avatars.githubusercontent.com/u/16278428?v=3","gravatar_id":"","url":"https://api.github.com/users/x0x7","html_url":"https://github.com/x0x7","followers_url":"https://api.github.com/users/x0x7/followers","following_url":"https://api.github.com/users/x0x7/following{/other_user}","gists_url":"https://api.github.com/users/x0x7/gists{/gist_id}","starred_url":"https://api.github.com/users/x0x7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/x0x7/subscriptions","organizations_url":"https://api.github.com/users/x0x7/orgs","repos_url":"https://api.github.com/users/x0x7/repos","events_url":"https://api.github.com/users/x0x7/events{/privacy}","received_events_url":"https://api.github.com/users/x0x7/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2016-02-08T13:52:29Z","updated_at":"2016-02-08T13:52:29Z","closed_at":null,"body":"So typically people should be aware root actions are about to be performed when they type in a command.\r\n\r\n$ letsencrypt --help would not instictually be thought of as a command needing root access.  It's fine that it does but not ideal.  What is troubling is the use of sudo inside the script.\r\n\r\nThis means that if they had just run a few commands as root (someone working on their https would be in server configuration mode) and then decided to read the most available cli documentation on your command.  BOOM.  Let's install all the things.\r\n\r\nA better solution would be to reject running with and give a prompt stating that root access is need, then allow the user to explicitly grant it for your program.\r\n\r\nThe golden rule should be never include sudo in anything.  I can't think of any tool on debian that does.  I know on arch systemctl prompts for raised privilage but it doesn't use sudo because each issue requires granted privaliges.  Let the user manage root access.  Don't seripticiously gain root access through the back door without permission.\r\n\r\nI'm sure you figured they would be prompted so it's all the same but sudo does have a grace period.  It is equal level of convinience for the user to sign for it on the outside of the program and is just polite.\r\n\r\nAlso considering this is a security project it gives people higher confidence that you know what you're doing.\r\n\r\nSorry to leave a potencially rude comment on your issues page.  I hope you don't read it that way.  Oviously in scale of rudeness I really don't have much to worry about as gaining root access without permission on someobodies server.  You can't go above that really.\r\n\r\nAnyways hopefully this was just a mistake ;)\r\n\r\nI'll see if I can make the edits for you guys."}}