Skip to content
This repository has been archived by the owner on Feb 27, 2024. It is now read-only.

Sudo for Windows aims to bring the familiar functionality of the linux Sudo command to Windows environments. It allows for full audit logging of all requests for elevation, along with the ability to tightly control which commands are allowed to be run by which users and groups.

License

Notifications You must be signed in to change notification settings

vmware-archive/sudo-for-microsoft-windows

Sudo For Microsoft Windows

Note: Active development on this project has ceased as of Feb 2024, and the project will no longer be maintained.

Current Project status - End of Life

Description

Sudo for Microsoft Windows aims to provide a familiar interface for allowing escalation of specific commands from within a Windows automation workflow. Our primary target is automated workflows, such as software builds and CI/CD pipelines, where elevation might be needed for a few operations, while most can be run within the privileges of a limited user. The native Windows methods of achieving this elevation (User Account Control, RunAs, etc) tend to have significant drawbacks when applied to automated processes. For example, allowing elevation via User Account Control is limited to a simple binary allow/deny for the elevation privilege, without very limited means of controlling what is run with the elevated privileges.

The eventual goal of the Sudo For Microsoft Windows project is to provide a means by which a software build can have a verifiable, secure method of specifying which commands will need escalation during the build, meaning that even if an attacker is able to compromise the build process itself, they are not able to escalate privileges on the system and take full control without also compromising the configuration and potentially even signing keys used to secure the configuration.

Usage

Current usage is limited to the following format:

> sudo.exe "C:\Path\To\Binary.exe argument1 argument2 -argument3..."

Please note that the full path to the binary (and any arguments specified) must match what is configured in the sudoers configuration file.

Client Return Codes

Code Meaning
0 Command completed successfully
1 Command exited with error
2 Error in Sudo Broker
3 Timeout while connecting to broker
4 Broker connection terminated prematurely
5 Unknown error

Contributing

The sudo-for-microsoft-windows project team welcomes contributions from the community. Before you start working with sudo-for-microsoft-windows, please read our Developer Certificate of Origin. All contributions to this repository must be signed as described on that page. Your signature certifies that you wrote the patch or have the right to pass it on as an open-source patch. For more detailed information, refer to CONTRIBUTING.md.

About

Sudo for Windows aims to bring the familiar functionality of the linux Sudo command to Windows environments. It allows for full audit logging of all requests for elevation, along with the ability to tightly control which commands are allowed to be run by which users and groups.

Resources

License

Code of conduct

Security policy

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages