Fix vtysh shell-ingestion security issue (sonic-net#7759)

Fix vtysh shell-ingestion security issue Only expose the limited parameters of the command vtysh show.
stephenxs · Jun 28, 2021 · 5c503b8 · 5c503b8
1 parent dbd086b
commit 5c503b8
Showing 1 changed file with 4 additions and 2 deletions.
diff --git a/files/image_config/sudoers/sudoers b/files/image_config/sudoers/sudoers
@@ -31,8 +31,10 @@ Cmnd_Alias      READ_ONLY_CMDS = /bin/cat /var/log/syslog*, \
                                  /usr/bin/sensors, \
                                  /usr/bin/tail -F /var/log/syslog, \
                                  /usr/bin/rvtysh *, \
-                                 /usr/bin/vtysh -c show *, \
-                                 /usr/bin/vtysh -n [0-9] -c show *, \
+                                 /usr/bin/vtysh -c show version, \
+                                 /usr/bin/vtysh -c show bgp ipv[46] summary json, \
+                                 /usr/bin/vtysh -n [0-9] -c show version, \
+                                 /usr/bin/vtysh -n [0-9] -c show bgp ipv[46] summary json, \
                                  /usr/local/bin/decode-syseeprom, \
                                  /usr/local/bin/generate_dump, \
                                  /usr/local/bin/ipintutil, \