Restrictions for commands or roles limits

[drklauss]

Good day, everyone. In our company we refused from Makefile to the favor of Supfile. We use sup for deploy, many members of my team can pull project from git repository and execute commands written in Supfile. Some of team members inattentive and careless, so they can accidentally run all commands. I think, that sup doesn't have enough security. I offer to inject several command limits or roles, for example add networks and targets section in each command section :

networks:
  dev:
    hosts:
      - localhost
  prod:
    hosts:
      - root@foo.bar.net

commands:
  go_fmt:
    desc: go formatting
    run: run gofmt -w ./
  go_build:
    desc: Сборка
    run: go build -o ./bin/api main.go
    targets: build # if command doesn't have the condition - you  can run command from any context
    networks: [ prod, dev] # same for this section
  link_config:
    desc: Link config to docker
    run: ln -f config.yaml docker/config.yaml
    targets: build
    networks: prod
targets:
  build:
    - go_fmt
    - go_build
    - link_config

In example above link_config can be run only so: sup prod build. It cannot be run itself. The same as for go_build - you can run it only in specific context (see targets and networks section). I think, that it is good descision for security deployment, which can provide safe deployment not only for main developer, but for everyone, who uses his project.

[groall]

It's good idea

[VojtechVitek]

targets:

I don't really see what targets: would give us in terms of security.

You could possibly make those commands hard to type, ie. insert a whitespace into the command key:

 " go_build":
    run: echo "This can be invoked from target, but it's hard to type in CLI"

Note that sup ENV go_build would not invoke this command, since it's missing the leading whitespace.

If you care about security, then don't give these developers access to production hosts. Give them access to dev/stg environment only :)

networks:

Instead of networks:, you can verify against $SUP_NETWORK variable, ie.:

 go_build:
    desc: Сборка, only in build network
    run: |
      [ $SUP_NETWORK != "build" ] && exit 0 || go build -o ./bin/api main.go